24:I[10321,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/3h6zdc-it88if.js","/_next/static/chunks/2vw2j18d9u3gs.js","/_next/static/chunks/3l_wb6il5gi_h.js"],"ReportDetailWrapper"] 109:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4ca,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious — Falcon Sandbox Report 68b8504446b8… — Score 60/100 — Sample 292ea9dbc5a1…","description":"Malicious verdict for sandbox report 68b8504446b8…. Threat score 60/100. 1 malicious and 10 suspicious behavioral indicators across 242 signatures. Detonated in Windows 10 64 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT\u0026CK mappings.","url":"/sample/292ea9dbc5a1d15b769edb5df1602418931122455223081064ad7ea4e8ab6821/68b8504446b83fb2480c50bd","keywords":["Malicious","sandbox report","malware analysis","MITRE ATT\u0026CK","292ea9dbc5a1d15b769edb5df1602418931122455223081064ad7ea4e8ab6821"],"about":{"@type":"SoftwareApplication","name":"x.exe","applicationCategory":"PE32 executable for MS Windows 4.00 (DLL), Intel i386 Mono/.Net assembly, 3 sections","identifier":"292ea9dbc5a1d15b769edb5df1602418931122455223081064ad7ea4e8ab6821","additionalType":"Malicious sample"},"threatScore":60,"sandboxEnvironment":"Windows 10 64 bit","behavioralIndicators":{"malicious":1,"suspicious":10,"totalSignatures":242},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC26:T2302,Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.74893000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp") Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "NtWriteVirtualMemory"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp") Found reference to API "NtCreateThread" (Indicator: "CreateThread"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp") Found reference to API "NtCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp") Found reference to API "NtAllocateVirtualMemoryEx" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "NtMapViewOfSectionEx" (Indicator: "NtMapViewOfSection"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "ZwMapViewOfSection" (Indicator: "ZwMapViewOfSection"; Source: "00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp") Found reference to API "DsRoleFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "NS_BIOSRead::APIHook_NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "ZwMapViewOfSection failed to map the end of the file [%x]" (Indicator: "ZwMapViewOfSection"; Source: "00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp") Found reference to API "ZwMapViewOfSection failed to map the start of the file [%x]" (Indicator: "ZwMapViewOfSection"; Source: "00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp")27:T45f,Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")28:T45f,Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")29:T411,Found reference to API "hook_CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "NtCreateThread" (Indicator: "NtCreateThread"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp") Found reference to API "NtCreateThreadEx" (Indicator: "NtCreateThread"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp")2a:T43e5,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.74736000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74768000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.748BB000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.74736000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74768000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.748BB000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.74701000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.76501000.00000020.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp") Found reference to API "IcmpSendEcho" (Indicator: "IcmpSendEcho"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74701000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "NtWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.74736000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp") Found reference to API "NtWaitForSingleObject" (Indicator: "NtWaitForSingleObject"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.74736000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "NtDelayExecution" (Indicator: "NtDelayExecution"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp") Found reference to API "NtWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp") Found reference to API "NtWaitForMultipleObjects" (Indicator: "NtWaitForMultipleObjects"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76501000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; Source: "00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76501000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "RegisterWaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "RegisterWaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")2b:T58f,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")2c:T84f,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.74736000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74768000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.748BB000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")2d:T84f,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.74736000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74768000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.748BB000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")2e:T46f,Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")2f:T471,Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")30:T4b1,Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.74701000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.76501000.00000020.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp")31:T58f,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")32:T84f,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.74736000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74768000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.748BB000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")33:T84f,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.74736000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74768000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.748BB000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")34:T46f,Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")35:T471,Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")36:T4b1,Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.74701000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.76501000.00000020.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp")37:T567,Found reference to API "SetupDiGetClassDevsA" (Indicator: "SetupDiGetClassDevs"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "SetupDiGetClassDevsW" (Indicator: "SetupDiGetClassDevs"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74D81000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "SetupDiEnumDeviceInfo" (Indicator: "SetupDiEnumDeviceInfo"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "SetupDiGetDeviceRegistryPropertyA" (Indicator: "SetupDiGetDeviceRegistryProperty"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp") Found reference to API "SetupDiGetDeviceRegistryPropertyW" (Indicator: "SetupDiGetDeviceRegistryProperty"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")38:T176d,Found reference to API "NtImpersonateThread" (Indicator: "NtImpersonateThread"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.74736000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "SetThreadToken" (Indicator: "SetThreadToken"; Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "[GetStringSID] Failed to OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NtOpenProcessToken failed [%x]" (Indicator: "OpenProcessToken"; Source: "00000000-00007376.00000000.113264.74491000.00000020.mdmp")39:T589,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")3a:T54d,Found reference to API "OpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")3b:T589,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")3c:T54d,Found reference to API "OpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")3d:T21ee,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74768000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.74768000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "LoadLibraryCWD" (Indicator: "LoadLibrary"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_ForceDXSetupSuccess::APIHook_LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_ForceDXSetupSuccess::APIHook_LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_ForceDXSetupSuccess::APIHook_LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_ForceDXSetupSuccess::APIHook_LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_ForceDXSetupSuccess::APIHook_FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_LoadLibraryCWD::NotifyFn" (Indicator: "LoadLibrary"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_LoadLibraryCWD::InitializeHooksMulti" (Indicator: "LoadLibrary"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp")3e:T789,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74768000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")3f:T752,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")40:T426,Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.74768000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")41:T789,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74768000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")42:T752,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")43:T426,Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.74768000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")44:T14c5,Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00007376.00000000.113264.00680000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00007376.00000000.113264.00680000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00007376.00000000.113264.00680000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00007376.00000000.113264.00680000.00000004.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "RegSetKeyValueW" (Indicator: "RegSetKeyValue"; Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "RegSetValueExW: wrp key is mitigated" (Indicator: "RegSetValue"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "RegSetValueA: wrp key is mitigated" (Indicator: "RegSetValue"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "RegSetValueW: wrp key is mitigated" (Indicator: "RegSetValue"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "RegSetValueExA: wrp key is mitigated" (Indicator: "RegSetValue"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "RegSetValueA" (Indicator: "RegSetValue"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "RegSetValueW" (Indicator: "RegSetValue"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.777D1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "SpellIt: RegSetValueEx failed" (Indicator: "RegSetValue"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "RegSetKeyValueA" (Indicator: "RegSetKeyValue"; Source: "00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")45:T5bc,Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")46:T5bc,Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")47:T659,Found reference to API "hook_ControlService" (Indicator: "ControlService"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "ControlService" (Indicator: "ControlService"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "ChangeServiceConfigA" (Indicator: "ChangeServiceConfig"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.74BC1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "ChangeServiceConfigW" (Indicator: "ChangeServiceConfig"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")48:T586,Found reference to API "hook_OpenServiceA" (Indicator: "OpenService"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "hook_OpenServiceW" (Indicator: "OpenService"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "OpenServiceA" (Indicator: "OpenService"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.74BC1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "OpenServiceW" (Indicator: "OpenService"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")49:Tb63,Found reference to API "BCryptEncrypt" (Indicator: "BCryptEncrypt"; Source: "00000000-00007376.00000000.113264.72F31000.00000020.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; Source: "00000000-00007376.00000000.113264.72F31000.00000020.mdmp, 00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; Source: "00000000-00007376.00000000.113264.72F31000.00000020.mdmp, 00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "BCryptImportKeyPair" (Indicator: "BCryptImportKey"; Source: "00000000-00007376.00000000.113264.72F31000.00000020.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00007376.00000000.113264.72F31000.00000020.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp") Found reference to API "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00007376.00000000.113264.72F31000.00000020.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "BCryptImportKey" (Indicator: "BCryptImportKey"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "BCryptGenerateKeyPair" (Indicator: "BCryptGenerateKeyPair"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")4a:T6fe,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007376-36839-20-00D21F2B Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007376-36839-20-00D21F2B Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007376-36839-24-00D21C84 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007376-36839-24-00D21C84 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007376-36839-27-00D21962 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007376-36839-27-00D21962 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00007376-36839-28-00D218B0 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00007376-36839-28-00D218B0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007376-36839-29-00D21DAF Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007376-36839-29-00D21DAF Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00007376-36839-31-00D23663 Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00007376-36839-31-00D23663 Assembly shows XOR instruction xor eax dword ptr [ebp-04h] in Stream UID: 00000000-00007376-36839-31-00D23663 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00007376-36839-31-00D23663 Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00007376-36839-31-00D23663 Assembly shows XOR instruction xor ecx eax in Stream UID: 00000000-00007376-36839-31-00D23663 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007376-36839-53-00D22C5A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007376-36839-53-00D22C5A4b:T532,Found reference to API "CryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00007376.00000000.113264.72F31000.00000020.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "DecryptMessage" (Indicator: "DecryptMessage"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74741000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "CryptUnprotectData" (Indicator: "CryptUnprotectData"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "BCryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")4c:T596,Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.74701000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.76501000.00000020.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp") Found reference to API "ZwQuerySystemInformation failed [%x]" (Indicator: "ZwQuerySystemInformation"; Source: "00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp")4d:T4b1,Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.74701000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.76501000.00000020.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp")4e:T4b1,Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.74701000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.76501000.00000020.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp")4f:T7fb,Found string "SMBIOSBIOSVersion" (Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp") Found string "UserName" (Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.746E1000.00000020.mdmp") Found string "hook_GetUserNameExA" (Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found string "hook_GetUserNameExW" (Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found string "GetUserNameA" (Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found string "GetUserNameW" (Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found string "lpMachineName" (Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found string "GetUserNameExA" (Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74741000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found string "GetUserNameExW" (Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.746E1000.00000020.mdmp, 00000000-00007376.00000000.113264.74741000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.77071000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found string "OSVersion" (Source: "00000000-00007376.00000000.113264.73051000.00000020.mdmp") Found string "OSVersionEx" (Source: "00000000-00007376.00000000.113264.73051000.00000020.mdmp") Found string "DNSMachineName" (Source: "00000000-00007376.00000000.113264.73051000.00000020.mdmp") Found string "MachineName" (Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp")50:T5e6,Found string "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.74701000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.76501000.00000020.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp") Found string "GetSystemFirmwareTable" (Indicator: "GetSystemFirmwareTable"; Source: "00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")51:T4a7,Found string "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.74701000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.76501000.00000020.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp")52:T4a7,Found string "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.74701000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.76501000.00000020.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp")53:T7e8,Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found string "GetCursorPos" (Indicator: "GetCursorPos"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found string "GetLastInputInfo" (Indicator: "GetLastInputInfo"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")54:T836,Found string "vmhgfs" (Indicator: "vmhgfs"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found string "vmmouse" (Indicator: "vmmouse"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found string "vmusbmouse" (Indicator: "vmusb"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found string "VMMemCtl" (Indicator: "vmmemctl"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found string "vmusb" (Indicator: "vmusb"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found string "vmx_svga" (Indicator: "vmx_svga"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found string "vmxnet" (Indicator: "vmxnet"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found string "vmx86" (Indicator: "vmx86"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found string "VBoxGuest" (Indicator: "VBoxGuest"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found string "VBoxMouse" (Indicator: "VBoxMouse"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found string "VBoxSF" (Indicator: "VBoxSF"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found string "VBoxWddm" (Indicator: "VBoxWddm"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found string "VBoxMouse.sys" (Indicator: "VBoxMouse"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found string "VBoxGuest.sys" (Indicator: "VBoxGuest"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found string "VBoxSF.sys" (Indicator: "VBoxSF"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found string "vmmouse.sys" (Indicator: "vmmouse"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found string "vmusbmouse.sys" (Indicator: "vmusb"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found string "vmmemctl.sys" (Indicator: "vmmemctl"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp")55:T907,Found reference to API "WTSOpenServerA" (Indicator: "WTSOpenServer"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "WTSOpenServerW" (Indicator: "WTSOpenServer"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "WTSOpenServerExA" (Indicator: "WTSOpenServer"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "WTSOpenServerExW" (Indicator: "WTSOpenServer"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "WTSEnumerateProcessesA" (Indicator: "WTSEnumerateProcesses"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "WTSEnumerateProcessesW" (Indicator: "WTSEnumerateProcesses"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "WTSEnumerateProcessesExA" (Indicator: "WTSEnumerateProcesses"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "WTSEnumerateProcessesExW" (Indicator: "WTSEnumerateProcesses"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "ProcessIdToSessionId" (Indicator: "ProcessIdToSessionId"; Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")56:Tab0,Found reference to API "AllocateAndInitializeSid failed %d" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "CheckTokenMembership failed: %d" (Indicator: "CheckTokenMembership"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")57:Tb69,Found string "hook_EnumServicesStatusA" (Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found string "hook_EnumServicesStatusW" (Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found string "hook_EnumServicesStatusExA" (Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found string "hook_EnumServicesStatusExW" (Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found string "EnumServicesStatusA" (Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp") Found string "EnumServicesStatusW" (Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found string "EnumServicesStatusExA" (Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found string "EnumServicesStatusExW" (Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found string "QueryServiceStatusEx" (Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found string "QueryServiceConfigW" (Source: "00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found string "QueryServiceStatus" (Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.74BC1000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")58:Tfb8,Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.748D1000.00000020.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.748D1000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.748D1000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "hook_GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "hook_GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")59:Tccf,Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetDiskFreeSpaceExA" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetDiskFreeSpaceExA" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GlobalMemoryStatus2GB" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_GlobalMemoryStatus2GB::APIHook_GlobalMemoryStatus" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_GlobalMemoryStatus2GB::InitializeHooksMulti" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "GlobalMemoryStatus" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")5a:T8a3,Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.748D1000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.748D1000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "EnumDateFormatsA" (Indicator: "EnumDateFormats"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "EnumDateFormatsExA" (Indicator: "EnumDateFormats"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "EnumDateFormatsExEx" (Indicator: "EnumDateFormats"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "EnumDateFormatsExW" (Indicator: "EnumDateFormats"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "EnumDateFormatsW" (Indicator: "EnumDateFormats"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")5b:T2a4c,Found system information discovery API: "GetSystemInfo" in "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74768000.00000002.mdmp, 00000000-00007376.00000000.113264.74893000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp" Found system information discovery API: "NtQuerySystemInformation" in "00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.74701000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.76501000.00000020.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp" Found system information discovery API: "ExpandEnvironmentStringsA" in "00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp" Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.7469D000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp" Found system information discovery API: "hook_GetNativeSystemInfo" in "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp" Found system information discovery API: "hook_GetMonitorInfoA" in "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp" Found system information discovery API: "hook_GetMonitorInfoW" in "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp" Found system information discovery API: "GetMonitorInfoA" in "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp" Found system information discovery API: "GetMonitorInfoW" in "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp" Found system information discovery API: "WTSRegisterSessionNotification" in "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp" Found system information discovery API: "WTSRegisterSessionNotificationEx" in "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp" Found system information discovery API: "NS_EmulateEnvironmentBlock::APIHook_GetEnvironmentStringsA" in "00000000-00007376.00000000.113264.730C1000.00000020.mdmp" Found system information discovery API: "NS_EmulateEnvironmentBlock::APIHook_GetEnvironmentStringsW" in "00000000-00007376.00000000.113264.730C1000.00000020.mdmp" Found system information discovery API: "GetEnvironmentStrings" in "00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp" Found system information discovery API: "GetEnvironmentStringsA" in "00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp" Found system information discovery API: "NS_ProfilesEnvStrings::APIHook_ExpandEnvironmentStringsA" in "00000000-00007376.00000000.113264.730C1000.00000020.mdmp" Found system information discovery API: "NS_ProfilesEnvStrings::APIHook_ExpandEnvironmentStringsW" in "00000000-00007376.00000000.113264.730C1000.00000020.mdmp" Found system information discovery API: "ExpandEnvironmentStringsW" in "00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp" Found system information discovery API: "[CreateFileA] ExpandEnvironmentStringsA failed" in "00000000-00007376.00000000.113264.730C1000.00000020.mdmp" Found system information discovery API: "ExpandEnvironmentStringsW failed" in "00000000-00007376.00000000.113264.730C1000.00000020.mdmp" Found system information discovery API: "GetUserObjectInformationW" in "00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74531000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.748D1000.00000020.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp" Found system information discovery API: "RtlGetNativeSystemInformation failed [%x]" in "00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp" Found system information discovery API: "ZwQuerySystemInformation failed [%x]" in "00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp"5c:T4c3,Found system information discovery API: "GetSystemInfo" in "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74768000.00000002.mdmp, 00000000-00007376.00000000.113264.74893000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"5d:T494,Found system information discovery API: "NtQuerySystemInformation" in "00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.74701000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.76501000.00000020.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp"5e:T6d5,Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.7469D000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp"5f:T421,Found system information discovery API: "ExpandEnvironmentStringsW" in "00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"60:T4c3,Found system information discovery API: "GetSystemInfo" in "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74768000.00000002.mdmp, 00000000-00007376.00000000.113264.74893000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"61:T494,Found system information discovery API: "NtQuerySystemInformation" in "00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.74701000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.76501000.00000020.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp"62:T6d5,Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.7469D000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp"63:T421,Found system information discovery API: "ExpandEnvironmentStringsW" in "00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"64:T11cc,Found reference to API "FilterSendMessage" (Indicator: "sendmessage"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74431000.00000020.mdmp") Found reference to API "hook_NtUserFindWindowEx" (Indicator: "findwindow"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "hook_EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "FindWindowA" (Indicator: "findwindow"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "FindWindowExA" (Indicator: "findwindow"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp") Found reference to API "FindWindowExW" (Indicator: "findwindow"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "FindWindowW" (Indicator: "findwindow"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.76501000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "SendMessage" (Indicator: "sendmessage"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "NtUserFindWindowEx" (Indicator: "findwindow"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.778D1000.00000020.mdmp") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; Source: "00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.74BC1000.00000020.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.76501000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; Source: "00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "DWM8And16Bit_EnumWindowsCallBack" (Indicator: "enumwindows"; Source: "00000000-00007376.00000000.113264.74491000.00000020.mdmp")65:T5f3,Found reference to API "IsWow64Process2" (Indicator: "IsWow64Process"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "hook_IsWow64Process" (Indicator: "IsWow64Process"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "IsWow64Process" (Indicator: "IsWow64Process"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")66:T9d3,Found string "SELECT * FROM MSACPI_THERMALZONETEMPERATURE" (Indicator: "select * from "; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp") Found string "SELECT * FROM WIN32_FAN" (Indicator: "select * from "; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp") Found string "SELECT * FROM WIN32_CACHEMEMORY" (Indicator: "select * from "; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp") Found string "SELECT * FROM WIN32_PHYSICALMEMORY" (Indicator: "select * from "; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp") Found string "SELECT * FROM WIN32_MEMORYDEVICE" (Indicator: "select * from "; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp") Found string "SELECT * FROM WIN32_MEMORYARRAY" (Indicator: "select * from "; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp") Found string "SELECT * FROM WIN32_VOLTAGEPROBE" (Indicator: "select * from "; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp") Found string "SELECT * FROM WIN32_PORTCONNECTOR" (Indicator: "select * from "; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp") Found string "SELECT * FROM WIN32_SMBIOSMEMORY" (Indicator: "select * from "; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp") Found string "SELECT * FROM WIN32_PERFFORMATTEDDATA_COUNTERS_THERMALZONEINFORMATION" (Indicator: "select * from "; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp") Found string "SELECT * FROM CIM_MEMORY" (Indicator: "select * from "; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp") Found string "SELECT * FROM CIM_NUMERICSENSOR" (Indicator: "select * from "; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp") Found string "SELECT * FROM CIM_PHYSICALCONNECTOR" (Indicator: "select * from "; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp") Found string "SELECT * FROM CIM_SENSOR" (Indicator: "select * from "; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp") Found string "SELECT * FROM CIM_SLOT" (Indicator: "select * from "; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp") Found string "SELECT * FROM CIM_TEMPERATURESENSOR" (Indicator: "select * from "; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp") Found string "SELECT * FROM CIM_VOLTAGESENSOR" (Indicator: "select * from "; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp")67:T498,Found reference to API "FindWindowA" (Indicator: "FindWindowA"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "FindWindowExA" (Indicator: "FindWindowExA"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp") Found reference to API "FindWindowExW" (Indicator: "FindWindowExW"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "FindWindowW" (Indicator: "FindWindowW"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.76501000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")68:Tc5a,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.74736000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74768000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.748BB000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.748D1000.00000020.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")69:T845,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.74736000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74768000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.748BB000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")6a:T845,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.74736000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74768000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.748BB000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")6b:T1049,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.74736000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74768000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.748BB000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetFileTime" (Indicator: "GetFileTime"; Source: "00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")6c:T84f,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.74736000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74768000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.748BB000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")6d:T84f,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.74736000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74768000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.748BB000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")6e:T567,Found reference to API "SetupDiGetClassDevsA" (Indicator: "SetupDiGetClassDevs"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "SetupDiGetClassDevsW" (Indicator: "SetupDiGetClassDevs"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74D81000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "SetupDiEnumDeviceInfo" (Indicator: "SetupDiEnumDeviceInfo"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "SetupDiGetDeviceRegistryPropertyA" (Indicator: "SetupDiGetDeviceRegistryProperty"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp") Found reference to API "SetupDiGetDeviceRegistryPropertyW" (Indicator: "SetupDiGetDeviceRegistryProperty"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")6f:Tc5a,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.74736000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74768000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.748BB000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.748D1000.00000020.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")70:T845,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.74736000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74768000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.748BB000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")71:T845,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.74736000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74768000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.748BB000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")72:T12c7,Found reference to API "hook_NtUserFindWindowEx" (Indicator: "FindWindow"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "hook_GetWindowTextA" (Indicator: "GetWindowText"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "hook_GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "hook_EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "FindWindowA" (Indicator: "FindWindow"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "FindWindowExA" (Indicator: "FindWindow"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "FindWindowW" (Indicator: "FindWindow"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.76501000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.76501000.00000020.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.74531000.00000020.mdmp, 00000000-00007376.00000000.113264.748D1000.00000020.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "NtUserFindWindowEx" (Indicator: "FindWindow"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.778D1000.00000020.mdmp") Found reference to API "EnumDesktopsW" (Indicator: "EnumDesktops"; Source: "00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp") Found reference to API "InternalGetWindowText" (Indicator: "GetWindowText"; Source: "00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "DWM8And16Bit_EnumWindowsCallBack" (Indicator: "EnumWindows"; Source: "00000000-00007376.00000000.113264.74491000.00000020.mdmp")73:T1eca,Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp") Found reference to API "hook_RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "Exception in hook_RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "VerifyVersionInfoLite" (Indicator: "VerifyVersionInfo"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "NS_FaultTolerantHeap::FthGetVersionString" (Indicator: "GetVersion"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_ForceDXSetupSuccess::DirectXSetupGetVersion" (Indicator: "GetVersion"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_VerifyVersionInfoLite::APIHook_VerifyVersionInfoA" (Indicator: "VerifyVersionInfo"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_VerifyVersionInfoLite::APIHook_VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_VerifyVersionInfoLite::InitializeHooksMulti" (Indicator: "VerifyVersionInfo"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "VerifyVersionInfoA" (Indicator: "VerifyVersionInfo"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "NS_VistaRTMVersionLie::APIHook_GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_VistaRTMVersionLie::APIHook_GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_VistaRTMVersionLie::APIHook_GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_VistaRTMVersionLie::APIHook_GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_VistaRTMVersionLie::APIHook_GetVersion" (Indicator: "GetVersion"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_VistaRTMVersionLie::APIHook_RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_VistaSP1VersionLie::APIHook_GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_VistaSP1VersionLie::APIHook_GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_VistaSP1VersionLie::APIHook_GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_VistaSP1VersionLie::APIHook_GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_VistaSP1VersionLie::APIHook_GetVersion" (Indicator: "GetVersion"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_VistaSP1VersionLie::APIHook_RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_VistaSP2VersionLie::APIHook_GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_VistaSP2VersionLie::APIHook_GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_VistaSP2VersionLie::APIHook_GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_VistaSP2VersionLie::APIHook_GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_VistaSP2VersionLie::APIHook_GetVersion" (Indicator: "GetVersion"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp")74:T5dd,Found reference to API "NtQueryVolumeInformationFile" (Indicator: "NtQueryVolumeInformationFile"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp") Found reference to API "GetVolumeNameForVolumeMountPointW" (Indicator: "GetVolumeNameForVolumeMountPoint"; Source: "00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetVolumePathNamesForVolumeNameW" (Indicator: "GetVolumePathNamesForVolumeName"; Source: "00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")75:T1626,Found registry modification API: "" in "00000000-00007376.00000000.113264.00680000.00000004.mdmp" Found registry modification API: "" in "00000000-00007376.00000000.113264.00680000.00000004.mdmp" Found registry modification API: "" in "00000000-00007376.00000000.113264.00680000.00000004.mdmp" Found registry modification API: "" in "00000000-00007376.00000000.113264.00680000.00000004.mdmp" Found registry modification API: "RegCreateKeyExA" in "00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp" Found registry modification API: "RegCreateKeyExW" in "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp" Found registry modification API: "RegCreateKeyExW: wrp key is mitigated" in "00000000-00007376.00000000.113264.730C1000.00000020.mdmp" Found registry modification API: "RegCreateKeyW: wrp key is mitigated" in "00000000-00007376.00000000.113264.730C1000.00000020.mdmp" Found registry modification API: "RegCreateKey: wrp key subkey mitigated" in "00000000-00007376.00000000.113264.730C1000.00000020.mdmp" Found registry modification API: "RegCreateKey: non-COM wrp subkey is not mitigated" in "00000000-00007376.00000000.113264.730C1000.00000020.mdmp" Found registry modification API: "RegCreateKeyA: wrp key is mitigated" in "00000000-00007376.00000000.113264.730C1000.00000020.mdmp" Found registry modification API: "RegCreateKeyExA: wrp key is mitigated" in "00000000-00007376.00000000.113264.730C1000.00000020.mdmp" Found registry modification API: "RegCreateKeyA" in "00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp" Found registry modification API: "RegCreateKeyW" in "00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.777D1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp" Found registry modification API: "RegConnectRegistryA" in "00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp" Found registry modification API: "RegConnectRegistryW" in "00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp" Found registry modification API: "NS_ProfilesRegQueryValueEx::APIHook_RegCreateKeyA" in "00000000-00007376.00000000.113264.730C1000.00000020.mdmp" Found registry modification API: "NS_ProfilesRegQueryValueEx::APIHook_RegCreateKeyW" in "00000000-00007376.00000000.113264.730C1000.00000020.mdmp" Found registry modification API: "NS_ProfilesRegQueryValueEx::APIHook_RegCreateKeyExA" in "00000000-00007376.00000000.113264.730C1000.00000020.mdmp" Found registry modification API: "NS_ProfilesRegQueryValueEx::APIHook_RegCreateKeyExW" in "00000000-00007376.00000000.113264.730C1000.00000020.mdmp" Found registry modification API: "RegCreateKey getting accedd denied on [%s]" in "00000000-00007376.00000000.113264.730C1000.00000020.mdmp" Found registry modification API: "NS_WRPMitigation::APIHook_RegCreateKeyA" in "00000000-00007376.00000000.113264.730C1000.00000020.mdmp"76:T5a6,Found registry modification API: "RegCreateKeyExW" in "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"77:T5a6,Found registry modification API: "RegCreateKeyExW" in "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"78:T10ea,Found reference to API "hook_OpenSCManagerA" (Indicator: "OpenSCManager"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "hook_OpenSCManagerW" (Indicator: "OpenSCManager"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "hook_EnumServicesStatusA" (Indicator: "EnumServicesStatus"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "hook_EnumServicesStatusW" (Indicator: "EnumServicesStatus"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "hook_EnumServicesStatusExA" (Indicator: "EnumServicesStatus"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "hook_EnumServicesStatusExW" (Indicator: "EnumServicesStatus"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "OpenSCManagerA" (Indicator: "OpenSCManager"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.74BC1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "OpenSCManagerW" (Indicator: "OpenSCManager"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "EnumServicesStatusA" (Indicator: "EnumServicesStatus"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp") Found reference to API "EnumServicesStatusW" (Indicator: "EnumServicesStatus"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "EnumServicesStatusExA" (Indicator: "EnumServicesStatus"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "EnumServicesStatusExW" (Indicator: "EnumServicesStatus"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "QueryServiceStatusEx" (Indicator: "QueryServiceStatus"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "QueryServiceStatus" (Indicator: "QueryServiceStatus"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.74BC1000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")79:Tb70,Found string "" (Indicator: "MoveFileA"; Source: "00000000-00007376.00000000.113264.00680000.00000004.mdmp") Found string "" (Indicator: "MoveFileW"; Source: "00000000-00007376.00000000.113264.00680000.00000004.mdmp") Found string "" (Indicator: "MoveFileExA"; Source: "00000000-00007376.00000000.113264.00680000.00000004.mdmp") Found string "" (Indicator: "MoveFileExW"; Source: "00000000-00007376.00000000.113264.00680000.00000004.mdmp") Found string "MoveFileA" (Indicator: "MoveFileA"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74531000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found string "MoveFileW" (Indicator: "MoveFileW"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74531000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found string "MoveFileExA" (Indicator: "MoveFileExA"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found string "MoveFileExW" (Indicator: "MoveFileExW"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found string "NS_MoveToCopyFileShim::APIHook_MoveFileA" (Indicator: "MoveFileA"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found string "[MoveFileA] DeleteFileA failed" (Indicator: "MoveFileA"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found string "NS_MoveToCopyFileShim::APIHook_MoveFileW" (Indicator: "MoveFileW"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found string "[MoveFileW] DeleteFileW failed" (Indicator: "MoveFileW"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp")7a:T550,Found string "GetCommandLineW" (Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found string "GetCommandLineA" (Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")7b:T12db,"regsvr32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007376) "regsvr32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007376) "regsvr32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007376) "regsvr32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007376) "regsvr32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007376) "regsvr32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007376) "regsvr32.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007376) "regsvr32.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007376) "regsvr32.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007376) "regsvr32.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007376) "regsvr32.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007376) "regsvr32.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007376) "regsvr32.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007376) "regsvr32.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007376) "regsvr32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007376) "regsvr32.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007376) "regsvr32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007376) "regsvr32.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007376) "regsvr32.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007376) "regsvr32.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007376) "regsvr32.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007376) "regsvr32.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007376) "regsvr32.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007376) "regsvr32.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007376) "regsvr32.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007376) "regsvr32.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007376) "regsvr32.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007376) "regsvr32.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007376) "regsvr32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007376) "regsvr32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007376) "regsvr32.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007376) "regsvr32.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007376) "regsvr32.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007376) "regsvr32.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007376) "regsvr32.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007376) "regsvr32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007376) "regsvr32.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007376) "regsvr32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007376) "regsvr32.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007376) "regsvr32.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007376) "regsvr32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007376) "regsvr32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007376) "regsvr32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007376) "regsvr32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007376) "regsvr32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007376) "regsvr32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007376) "regsvr32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007376)7c:Ta18,"SELECT * FROM MSACPI_THERMALZONETEMPERATURE" (Source: 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, Indicator: "select * from msacpi_thermalzonetemperature") "SELECT * FROM WIN32_FAN" (Source: 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, Indicator: "select * from win32_fan") "SELECT * FROM WIN32_CACHEMEMORY" (Source: 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, Indicator: "select * from win32_cachememory") "SELECT * FROM WIN32_PHYSICALMEMORY" (Source: 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, Indicator: "select * from win32_physicalmemory") "SELECT * FROM WIN32_MEMORYDEVICE" (Source: 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, Indicator: "select * from win32_memorydevice") "SELECT * FROM WIN32_MEMORYARRAY" (Source: 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, Indicator: "select * from win32_memoryarray") "SELECT * FROM WIN32_VOLTAGEPROBE" (Source: 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, Indicator: "select * from win32_voltageprobe") "SELECT * FROM WIN32_PORTCONNECTOR" (Source: 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, Indicator: "select * from win32_portconnector") "SELECT * FROM WIN32_SMBIOSMEMORY" (Source: 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, Indicator: "select * from win32_smbiosmemory") "SELECT * FROM WIN32_PERFFORMATTEDDATA_COUNTERS_THERMALZONEINFORMATION" (Source: 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, Indicator: "select * from win32_perfformatteddata_counters_thermalzoneinformation") "SELECT * FROM CIM_MEMORY" (Source: 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, Indicator: "select * from cim_memory") "SELECT * FROM CIM_NUMERICSENSOR" (Source: 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, Indicator: "select * from cim_numericsensor") "SELECT * FROM CIM_PHYSICALCONNECTOR" (Source: 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, Indicator: "select * from cim_physicalconnector") "SELECT * FROM CIM_SENSOR" (Source: 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, Indicator: "select * from cim_sensor") "SELECT * FROM CIM_SLOT" (Source: 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, Indicator: "select * from cim_slot") "SELECT * FROM CIM_TEMPERATURESENSOR" (Source: 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, Indicator: "select * from cim_temperaturesensor") "SELECT * FROM CIM_VOLTAGESENSOR" (Source: 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, Indicator: "select * from cim_voltagesensor")7d:T116a,Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "hook_CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "hook_CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "CreateProcessWithTokenW" (Indicator: "CreateProcess"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "CreateProcessAsUserW" (Indicator: "CreateProcess"; Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_ElevateCreateProcess::IsExeManifested" (Indicator: "CreateProcess"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_ElevateCreateProcess::AdminCheckAndLaunch" (Indicator: "CreateProcess"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_ElevateCreateProcess::WidenStringsAndLaunch" (Indicator: "CreateProcess"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_ElevateCreateProcess::APIHook_CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_ElevateCreateProcess::APIHook_CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_ElevateCreateProcess::APIHook_WinExec" (Indicator: "CreateProcess"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_ElevateCreateProcess::APIHook_RegisterWaitForInputIdle" (Indicator: "CreateProcess"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_ElevateCreateProcess::InitializeHooksMulti" (Indicator: "CreateProcess"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "[LaunchFeedbackUI] CreateProcess failed" (Indicator: "CreateProcess"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "CreateProcessAsUserA" (Indicator: "CreateProcess"; Source: "00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")7e:T6e9,Found reference to API "hook_CreateDirectoryA" (Indicator: "CreateDirectory"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "hook_CreateDirectoryW" (Indicator: "CreateDirectory"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "CreateDirectoryA" (Indicator: "CreateDirectory"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "CreateDirectoryW" (Indicator: "CreateDirectory"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "NtCreateDirectoryObject" (Indicator: "CreateDirectory"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp")7f:T8bb,Found reference to API "NtDeviceIoControlFile" (Indicator: "NtDeviceIoControlFile"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.74736000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp") Found reference to API "NtDeviceIoControlFile" (Indicator: "DeviceIoControl"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.74736000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp") Found reference to API "NtFsControlFile" (Indicator: "FsControlFile"; Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.74736000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp")80:T22f2,Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00007376.00000000.113264.00680000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00007376.00000000.113264.00680000.00000004.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "NtOpenFile" (Indicator: "NtOpenFile"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.74736000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74893000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp") Found reference to API "NtCreateFile" (Indicator: "CreateFile"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp") Found reference to API "NtCreateFile" (Indicator: "NtCreateFile"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp") Found reference to API "NS_RedirectBDE::APIHook_CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "[CreateFileA] ExpandEnvironmentStringsA failed" (Indicator: "CreateFile"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "[CreateFileA] Unexpected failure after redirection." (Indicator: "CreateFile"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_SyncSystem32AndSysWow64::APIHook_CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_SyncSystem32AndSysWow64::APIHook_CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_SyncSystemAndSystem32::APIHook_CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_SyncSystemAndSystem32::APIHook_CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NtCreateFile failed [%x]" (Indicator: "CreateFile"; Source: "00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "NtCreateFile failed [%x]" (Indicator: "NtCreateFile"; Source: "00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; Source: "00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")81:T6a0,Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")82:T463,Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")83:T6a0,Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")84:T463,Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")85:T74f,Found reference to API "RegCloseKey" (Indicator: "RegCloseKey"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74893000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")86:T74f,Found reference to API "RegCloseKey" (Indicator: "RegCloseKey"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74893000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")87:T74f,Found reference to API "RegCloseKey" (Indicator: "RegCloseKey"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74893000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")88:T4e7,Found reference to API "hook_ShellExecuteA" (Indicator: "ShellExecute"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "hook_ShellExecuteW" (Indicator: "ShellExecute"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "hook_WinExec" (Indicator: "WinExec"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "ShellExecuteA" (Indicator: "ShellExecute"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "ShellExecuteW" (Indicator: "ShellExecute"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "WinExec" (Indicator: "WinExec"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "NS_ElevateCreateProcess::APIHook_WinExec" (Indicator: "WinExec"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp")89:T133e,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "hook_FindResourceA" (Indicator: "FindResource"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "hook_FindResourceW" (Indicator: "FindResource"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "hook_LoadResource" (Indicator: "LoadResource"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "LdrResFindResource failed [%x]" (Indicator: "FindResource"; Source: "00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp") Found reference to API "LdrResFindResource failed %ls [%x]" (Indicator: "FindResource"; Source: "00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp") Found reference to API "LdrResFindResource returned null version block with status: [%x]" (Indicator: "FindResource"; Source: "00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp")8a:Tbd4,Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00007376.00000000.113264.00680000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00007376.00000000.113264.00680000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00007376.00000000.113264.00680000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00007376.00000000.113264.00680000.00000004.mdmp") Found reference to API "MoveFileA" (Indicator: "MoveFile"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74531000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "MoveFileW" (Indicator: "MoveFile"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74531000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "MoveFileExA" (Indicator: "MoveFile"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "MoveFileExW" (Indicator: "MoveFile"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "NS_MoveToCopyFileShim::APIHook_MoveFileA" (Indicator: "MoveFile"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "[MoveFileA] DeleteFileA failed" (Indicator: "MoveFile"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_MoveToCopyFileShim::APIHook_MoveFileW" (Indicator: "MoveFile"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "[MoveFileW] DeleteFileW failed" (Indicator: "MoveFile"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp")8b:T59e,Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")8c:T24f5,Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "NtCreateThread" (Indicator: "CreateThread"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp") Found reference to API "NtCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp") Found reference to API "NtResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp") Found reference to API "NtSuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.74736000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")8d:T45f,Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")8e:T548,Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")8f:T45f,Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")90:T548,Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")91:T121b,Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74768000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "NtOpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "[GetStringSID] Failed to OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NtOpenProcessToken failed [%x]" (Indicator: "OpenProcess"; Source: "00000000-00007376.00000000.113264.74491000.00000020.mdmp")92:T71b,Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74768000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")93:T584,Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")94:T71b,Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74768000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")95:T584,Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")96:T10fd,Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74768000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74893000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74893000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetLastError()" (Indicator: "GetLastError"; Source: "00000000-00007376.00000000.113264.72F31000.00000020.mdmp, 00000000-00007376.00000000.113264.73451000.00000020.mdmp")97:T8ad,Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74768000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74893000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")98:T78b,Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74893000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")99:T8ad,Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74768000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74893000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")9a:T78b,Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74893000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")9b:Tba71,"SOFTWARE\Microsoft\SystemCertificates\Root\Certificates\2BD63D28D7BCD0E251195AEB519243C13142EBC3" in Source: 00000000-00007376.00000000.113264.72F31000.00000020.mdmp "SOFTWARE\Microsoft\SystemCertificates\Root\Certificates\8A334AA8052DD244A647306A76B8178FA215F344" in Source: 00000000-00007376.00000000.113264.72F31000.00000020.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider" in Source: 00000000-00007376.00000000.113264.72F31000.00000020.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\" in Source: 00000000-00007376.00000000.113264.72F31000.00000020.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type" in Source: 00000000-00007376.00000000.113264.72F31000.00000020.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types" in Source: 00000000-00007376.00000000.113264.72F31000.00000020.mdmp "SOFTWARE\Microsoft\Cryptography\Providers\Type" in Source: 00000000-00007376.00000000.113264.72F31000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\Print" in Source: 00000000-00007376.00000000.113264.73051000.00000020.mdmp "System\CurrentControlSet\Control\Print" in Source: 00000000-00007376.00000000.113264.73051000.00000020.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00007376.00000000.113264.73051000.00000020.mdmp 00000000-00007376.00000000.113264.77071000.00000020.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00007376.00000000.113264.73051000.00000020.mdmp "System\CurrentControlSet\Control\Print\Environments" in Source: 00000000-00007376.00000000.113264.73051000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib" in Source: 00000000-00007376.00000000.113264.73051000.00000020.mdmp 00000000-00007376.00000000.113264.74781000.00000020.mdmp "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "SOFTWARE\CLASSES\PACKAGEDCOM\PACKAGE" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "SOFTWARE\Microsoft\Office\16.0" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "SOFTWARE\Wow6432Node\Microsoft\Office\16.0" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCU\%s\COMMON\GENERAL" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\%s\COMMON\InstallRoot" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCU\%s\%s" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\%s\%s\InstallRoot" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCU\SOFTWARE\Classes\%s.Application\CurVer" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCU\SOFTWARE\Classes\%s.Application.%s" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\%s.Application\CurVer" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\%s.Application.%s" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\%s.Application\CurVer" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\%s.Application.%s" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\%s\%s" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\%s\LocalServer" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\%s\LocalServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\%s\LocalServer" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\%s\LocalServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\WOW6432Node\CLSID\%s\LocalServer" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\WOW6432Node\CLSID\%s\LocalServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "\Registry\Machine\Software\Classes\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Classes\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "\Registry\Machine\System\ControlSet001\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp 00000000-00007376.00000000.113264.77071000.00000020.mdmp "HKCR\Excel.Application\CLSID" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\WOW6432Node\CLSID\{00024500-0000-0000-C000-000000000046}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\WOW6432Node\CLSID\{00024500-0000-0000-C000-000000000046}\Implemented Categories" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\WOW6432Node\CLSID\{00024500-0000-0000-C000-000000000046}\Implemented Categories\{000C0118-0000-0000-C000-000000000046}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\WOW6432Node\CLSID\{00024500-0000-0000-C000-000000000046}\InprocHandler32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\WOW6432Node\CLSID\{00024500-0000-0000-C000-000000000046}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\WOW6432Node\CLSID\{00024500-0000-0000-C000-000000000046}\InprocServer32\15.0.0.0" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\WOW6432Node\CLSID\{00024500-0000-0000-C000-000000000046}\LocalServer" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\WOW6432Node\CLSID\{00024500-0000-0000-C000-000000000046}\LocalServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\WOW6432Node\CLSID\{00024500-0000-0000-C000-000000000046}\ProgID" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\WOW6432Node\CLSID\{00024500-0000-0000-C000-000000000046}\VersionIndependentProgID" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\Excel.Application\CLSID" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{00024500-0000-0000-C000-000000000046}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{00024500-0000-0000-C000-000000000046}\Implemented Categories" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{00024500-0000-0000-C000-000000000046}\Implemented Categories\{000C0118-0000-0000-C000-000000000046}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{00024500-0000-0000-C000-000000000046}\InprocHandler32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{00024500-0000-0000-C000-000000000046}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{00024500-0000-0000-C000-000000000046}\InprocServer32\15.0.0.0" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{00024500-0000-0000-C000-000000000046}\LocalServer" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{00024500-0000-0000-C000-000000000046}\LocalServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{00024500-0000-0000-C000-000000000046}\ProgID" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{00024500-0000-0000-C000-000000000046}\VersionIndependentProgID" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\Outlook.Application" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\Outlook.Application\CLSID" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCU\SOFTWARE\Classes\Outlook.Application" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCU\SOFTWARE\Classes\Outlook.Application\CLSID" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\Interface\{00063001-0000-0000-C000-000000000046}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\Interface\{00063001-0000-0000-C000-000000000046}\ProxyStubClsid" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\Interface\{00063001-0000-0000-C000-000000000046}\ProxyStubClsid32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\Interface\{00063001-0000-0000-C000-000000000046}\TypeLib" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\Interface\{00063001-0000-0000-C000-000000000046}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\Interface\{00063001-0000-0000-C000-000000000046}\ProxyStubClsid" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\Interface\{00063001-0000-0000-C000-000000000046}\ProxyStubClsid32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\Interface\{00063001-0000-0000-C000-000000000046}\TypeLib" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCU\SOFTWARE\Classes\Interface\{00063001-0000-0000-C000-000000000046}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCU\SOFTWARE\Classes\Interface\{00063001-0000-0000-C000-000000000046}\ProxyStubClsid" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCU\SOFTWARE\Classes\Interface\{00063001-0000-0000-C000-000000000046}\ProxyStubClsid32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCU\SOFTWARE\Classes\Interface\{00063001-0000-0000-C000-000000000046}\TypeLib" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Microsoft\Office\16.0\Outlook" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\16.0\Outlook" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Clients\Mail\Microsoft Outlook" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{91493441-5A91-11CF-8700-00AA0060263B}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{91493441-5A91-11CF-8700-00AA0060263B}\InprocServer32\15.0.0.0" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\PowerPoint.Application\CLSID" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\WOW6432Node\CLSID\{91493441-5A91-11CF-8700-00AA0060263B}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\WOW6432Node\CLSID\{91493441-5A91-11CF-8700-00AA0060263B}\InprocHandler" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\WOW6432Node\CLSID\{91493441-5A91-11CF-8700-00AA0060263B}\InprocHandler32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\WOW6432Node\CLSID\{91493441-5A91-11CF-8700-00AA0060263B}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\WOW6432Node\CLSID\{91493441-5A91-11CF-8700-00AA0060263B}\InprocServer32\15.0.0.0" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\WOW6432Node\CLSID\{91493441-5A91-11CF-8700-00AA0060263B}\LocalServer" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\WOW6432Node\CLSID\{91493441-5A91-11CF-8700-00AA0060263B}\LocalServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\WOW6432Node\CLSID\{91493441-5A91-11CF-8700-00AA0060263B}\ProgID" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\WOW6432Node\CLSID\{91493441-5A91-11CF-8700-00AA0060263B}\VersionIndependentProgID" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\CLSID\{91493441-5A91-11CF-8700-00AA0060263B}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\CLSID\{91493441-5A91-11CF-8700-00AA0060263B}\InprocServer32\15.0.0.0" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\PowerPoint.Application\CLSID" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{91493441-5A91-11CF-8700-00AA0060263B}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{91493441-5A91-11CF-8700-00AA0060263B}\InprocHandler" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{91493441-5A91-11CF-8700-00AA0060263B}\InprocHandler32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{91493441-5A91-11CF-8700-00AA0060263B}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{91493441-5A91-11CF-8700-00AA0060263B}\InprocServer32\15.0.0.0" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{91493441-5A91-11CF-8700-00AA0060263B}\LocalServer" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{91493441-5A91-11CF-8700-00AA0060263B}\LocalServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{91493441-5A91-11CF-8700-00AA0060263B}\ProgID" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{91493441-5A91-11CF-8700-00AA0060263B}\VersionIndependentProgID" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\Word.Application\CLSID" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\WOW6432Node\CLSID\{000209FF-0000-0000-C000-000000000046}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\WOW6432Node\CLSID\{000209FF-0000-0000-C000-000000000046}\InprocHandler32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\WOW6432Node\CLSID\{000209FF-0000-0000-C000-000000000046}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\WOW6432Node\CLSID\{000209FF-0000-0000-C000-000000000046}\InprocServer32\15.0.0.0" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\WOW6432Node\CLSID\{000209FF-0000-0000-C000-000000000046}\LocalServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\WOW6432Node\CLSID\{000209FF-0000-0000-C000-000000000046}\ProgID" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\WOW6432Node\CLSID\{000209FF-0000-0000-C000-000000000046}\VersionIndependentProgID" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\Word.Application\CLSID" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{000209FF-0000-0000-C000-000000000046}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{000209FF-0000-0000-C000-000000000046}\InprocHandler32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{000209FF-0000-0000-C000-000000000046}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{000209FF-0000-0000-C000-000000000046}\InprocServer32\15.0.0.0" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{000209FF-0000-0000-C000-000000000046}\LocalServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{000209FF-0000-0000-C000-000000000046}\ProgID" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{000209FF-0000-0000-C000-000000000046}\VersionIndependentProgID" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "System\CurrentControlSet" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "SOFTWARE\Classes\CLSID\%ls\LocalServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "SOFTWARE\Classes\CLSID" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCU\Software\Classes\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "Software\Classes\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp 00000000-00007376.00000000.113264.74781000.00000020.mdmp 00000000-00007376.00000000.113264.74D81000.00000020.mdmp 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "HKCC\System\CurrentControlSet\Control\Print\Printers" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Microsoft\Direct3D" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "Software\Classes\Body5\Open\Shell\Command" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Encore Software\Middle School Advantage 2001\1.0" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\nowcom" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCU\Software\nowcom" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\nowirc" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCU\Software\nowirc" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\nownuri" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCU\Software\nownuri" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Microsoft\MSN" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\MSN" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Config\0001\Display\Settings" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "System\CurrentControlSet\Enum" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp 00000000-00007376.00000000.113264.76941000.00000020.mdmp "HKLM\System\CurrentControlSet\Enum" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCU\Software\Microsoft\CTF\LangBar" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\ODBC" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\System\CurrentControlSet\services\W3svc\Parameters" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Microsoft\Outlook Express\Inetcomm" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Microsoft\Outlook Express\Version Info" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{4CB63E61-C611-11D0-83AA-000092900184}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{4CB63E61-C611-11D0-83AA-000092900184}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{4CB63E61-C611-11D0-83AA-000092900184}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{4CB63E62-C611-11D0-83AA-000092900184}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{4CB63E62-C611-11D0-83AA-000092900184}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{B4CA2970-DD2B-11D0-9DFA-00AA00AF3494}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{B4CA2970-DD2B-11D0-9DFA-00AA00AF3494}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{B4CA2970-DD2B-11D0-9DFA-00AA00AF3494}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{B4CA2971-DD2B-11D0-9DFA-00AA00AF3494}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{B4CA2971-DD2B-11D0-9DFA-00AA00AF3494}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{C83B5610-E0DF-11D0-9E00-00AA00AF3494}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{C83B5610-E0DF-11D0-9E00-00AA00AF3494}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Microsoft\Windows NT\CurrentVersion\drivers.desc" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{31345649-0000-0010-8000-00AA00389B71}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{31345649-0000-0010-8000-00AA00389B71}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{31345649-0000-0010-8000-00AA00389B71}\Pins\Input" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{31345649-0000-0010-8000-00AA00389B71}\Pins\Input\Types\{73646976-0000-0010-8000-00AA00389B71}\{31345649-0000-0010-8000-00AA00389B71}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{31345649-0000-0010-8000-00AA00389B71}\Pins\Output" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{31345649-0000-0010-8000-00AA00389B71}\Pins\Output\Types\{73646976-0000-0010-8000-00AA00389B71}\{00000000-0000-0000-0000-000000000000}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{87CA6F02-49E4-11CF-A3FE-00AA003735BE}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{87CA6F02-49E4-11CF-A3FE-00AA003735BE}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{87CA6F04-49E4-11CF-A3FE-00AA003735BE}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{87CA6F04-49E4-11CF-A3FE-00AA003735BE}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{A2551F60-705F-11CF-A424-00AA003735BE}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{A2551F60-705F-11CF-A424-00AA003735BE}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{A2551F60-705F-11CF-A424-00AA003735BE}\Pins\Input" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{A2551F60-705F-11CF-A424-00AA003735BE}\Pins\Input\Types\{73646976-0000-0010-8000-00AA00389B71}\{00000000-0000-0000-0000-000000000000}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{A2551F60-705F-11CF-A424-00AA003735BE}\Pins\Output" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{A2551F60-705F-11CF-A424-00AA003735BE}\Pins\Output\Types\{73646976-0000-0010-8000-00AA00389B71}\{31345649-0000-0010-8000-00AA00389B71}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{BD323430-CE94-11CE-82DD-0800095A5B55}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{BD323430-CE94-11CE-82DD-0800095A5B55}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{BD323431-CE94-11CE-82DD-0800095A5B55}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{BD323431-CE94-11CE-82DD-0800095A5B55}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{BD323432-CE94-11CE-82DD-0800095A5B55}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{BD323432-CE94-11CE-82DD-0800095A5B55}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{BD323433-CE94-11CE-82DD-0800095A5B55}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{BD323433-CE94-11CE-82DD-0800095A5B55}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\Filter\{31345649-0000-0010-8000-00AA00389B71}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\Filter\{A2551F60-705F-11CF-A424-00AA003735BE}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCU\Software\Intel\Indeo\4.1" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{1F73E9B1-8C3A-11D0-A3BE-00A0C9244436}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{30355649-0000-0010-8000-00AA00389B71}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{1F73E9B1-8C3A-11D0-A3BE-00A0C9244436}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{1F73E9B1-8C3A-11D0-A3BE-00A0C9244436}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{2DE89781-DBF6-11D0-A30E-444553540000}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{2DE89781-DBF6-11D0-A30E-444553540000}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{30355649-0000-0010-8000-00AA00389B71}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{30355649-0000-0010-8000-00AA00389B71}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{33D9A760-90C8-11D0-BD43-00A0C911CE86}\Instance\Indeo" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{665A4443-D905-11D0-A30E-444553540000}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{665A4443-D905-11D0-A30E-444553540000}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{665A4444-D905-11D0-A30E-444553540000}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{665A4444-D905-11D0-A30E-444553540000}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{665A4445-D905-11D0-A30E-444553540000}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{665A4445-D905-11D0-A30E-444553540000}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{665A4448-D905-11D0-A30E-444553540000}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{665A4448-D905-11D0-A30E-444553540000}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{665A444A-D905-11D0-A30E-444553540000}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{665A444A-D905-11D0-A30E-444553540000}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{84725EA1-2FBC-11D1-BC86-00A0C969FC67}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{84725EA1-2FBC-11D1-BC86-00A0C969FC67}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{C1C0FE00-F3C2-11D0-91D4-444553540000}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{C1C0FE00-F3C2-11D0-91D4-444553540000}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{E369A160-F3C2-11D0-91D4-444553540000}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{E369A160-F3C2-11D0-91D4-444553540000}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\Interface\{665A4447-D905-11D0-A30E-444553540000}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\Interface\{665A4447-D905-11D0-A30E-444553540000}\ProxyStubClsid" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\Interface\{665A4447-D905-11D0-A30E-444553540000}\ProxyStubClsid32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\Interface\{665A4447-D905-11D0-A30E-444553540000}\TypeLib" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\Interface\{665A4449-D905-11D0-A30E-444553540000}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\Interface\{665A4449-D905-11D0-A30E-444553540000}\ProxyStubClsid" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\Interface\{665A4449-D905-11D0-A30E-444553540000}\ProxyStubClsid32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\Interface\{665A4449-D905-11D0-A30E-444553540000}\TypeLib" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\TypeLib\{665A4446-D905-11D0-A30E-444553540000}\1.0" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\TypeLib\{665A4446-D905-11D0-A30E-444553540000}\1.0\0\win32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\TypeLib\{665A4446-D905-11D0-A30E-444553540000}\1.0\FLAGS" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\TypeLib\{665A4446-D905-11D0-A30E-444553540000}\1.0\HELPDIR" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCU\Software\Classes\iTunes.BurnCD" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\iTunes.BurnCD" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCU\Software\Classes\MIME\Database\Content Type\application/x-itunes-itms" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\MIME\Database\Content Type\application/x-itunes-itms" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCU\Software\Classes\MIME\Database\Content Type\application/x-itunes-itpc" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\MIME\Database\Content Type\application/x-itunes-itpc" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCU\Software\Classes\MIME\Database\Content Type\application/x-podcast" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\MIME\Database\Content Type\application/x-podcast" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SYSTEM\ControlSet001\Control\ProductOptions" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SYSTEM\ControlSet002\Control\ProductOptions" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SYSTEM\ControlSet003\Control\ProductOptions" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\chm.file\shell\open\command" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\software\microsoft\IE Setup\SETUP" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\software\microsoft\Windows NT\CurrentVersion\Hotfix\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SYSTEM\WPA\MediaCenter" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\software\microsoft\Outlook Express" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Microsoft\Direct3D" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Microsoft\DirectDraw" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCU\Software\Microsoft\Windows\CurrentVersion\ThemeManager" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Microsoft\WAB\DLLPath" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCU\Software\Microsoft\Direct3D" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Microsoft\Internet Explorer\Version Vector" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Client" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Macromedia\FlashPlayerActiveY_BOGUSKEY" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Macromedia\FlashPlayerActiveX" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{031E4825-7B94-4dc3-B131-E946B44C8DD5}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Wow6432Node\Microsoft\NET Framework Setup\NDP\v4\Client" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Wow6432Node\Microsoft\NET Framework Setup\NDP\v4\Full" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Wow6432Node\Microsoft\Internet Explorer" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Microsoft\Windows\CurrentVersion\Controls Folder\Desk" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Microsoft\Windows\CurrentVersion\Controls Folder\Display" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\System\CurrentControlSet\Control\Class" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\System\CurrentControlSet\Services\Class" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\System\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\System\CurrentControlSet\Services\Class\Display" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Special Paths\Cookies" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "SOFTWARE\Hasbro Interactive" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SYSTEM\CurrentControlSet\Enum" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Enum" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "SYSTEM\CurrentControlSet\Enum\PCI" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCC\Software\Fonts" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "System\CurrentControlSet\Control\Nls\Locale" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\WORDPAD.EXE" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\rtffile\shell\open\command" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\rtffile\shell\print\command" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\rtffile\shell\printto\command" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\Wordpad.Document.1\shell\open\command" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\Wordpad.Document.1\shell\print\command" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\Wordpad.Document.1\shell\printto\command" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\wrifile\shell\open\command" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\wrifile\shell\print\command" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\wrifile\shell\printto\command" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Classes\Applications\wordpad.exe\shell\open\command" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Classes\Applications\wordpad.exe\shell\print\command" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Classes\Applications\wordpad.exe\shell\printto\command" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Classes\rtffile\shell\open\command" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Classes\rtffile\shell\print\command" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Classes\rtffile\shell\printto\command" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Classes\Wordpad.Document.1\shell\open\command" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Classes\Wordpad.Document.1\shell\print\command" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Classes\Wordpad.Document.1\shell\printto\command" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Classes\wrifile\shell\open\command" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Classes\wrifile\shell\print\command" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Classes\wrifile\shell\printto\command" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Microsoft\Windows\CurrentVersion\Setup" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "System\CurrentControlSet\Services\NetBT" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "Software\Microsoft\Windows NT\CurrentVersion\NetworkCards" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\System\CurrentControlSet\Control\Windows" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Microsoft\DirectX" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\DXDIAG.EXE" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Electronic Arts\Future Cop\Settings" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Drivers32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\System\CurrentControlSet\Control\MediaResources\ACM\MSACM.MSADPCM" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Microsoft\Windows" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCU\Software\Microsoft\Windows" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "Software\FirstByte\ProVoice\SpeechFonts" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Microsoft\Internet Explorer" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "System\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\OEM" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCU\Software\Adobe" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Adobe" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Adobe\PageMaker65" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCU\Software\Adobe\PageMaker65" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCU\Software\Caere Corp\PageKeepPro30\Preference" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "Software\Caere Corp\Scan Manager\4.02\Scanners" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SYSTEM\CurrentControlSet\Enum\Root" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Installer\UserData\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Components\359E92CC2CB71D119A12000A9CE1A22A" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\System\CurrentControlSet\Services\W3SVC\Parameters" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\System\CurrentControlSet\Control\MediaResources\DirectSound\Application Compatibility" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "\Registry\Machine\SOFTWARE\Policies\Microsoft\Windows NT\Windows File Protection" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "\Registry\HKEY_CURRENT_USER\Software\Classes\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "Software\Volatile\00" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy" in Source: 00000000-00007376.00000000.113264.73451000.00000020.mdmp 00000000-00007376.00000000.113264.74841000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Lsa" in Source: 00000000-00007376.00000000.113264.73451000.00000020.mdmp 00000000-00007376.00000000.113264.74841000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Accent" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp "Software\Policies\Microsoft\Windows\Personalization" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp "Software\Microsoft\Windows\DWM" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\ImmersiveShell" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\ThemeManager" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\DiagnosticAnimationXML" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp 00000000-00007376.00000000.113264.746E1000.00000020.mdmp ".Default\Software\Microsoft\Windows\CurrentVersion\ThemeManager" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Themes\History\Colors" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Themes\History" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Accents" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp "Software\Microsoft\Wisp\Touch" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp "\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp 00000000-00007376.00000000.113264.77110000.00000002.mdmp 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp "\Software\Classes\CLSID\" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\ProfileList" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp "\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp "\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp 00000000-00007376.00000000.113264.77110000.00000002.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Disable8And16BitMitigation" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp9c:T169db,"SOFTWARE\Microsoft\Cryptography\Defaults\Provider" in Source: 00000000-00007376.00000000.113264.72F31000.00000020.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\" in Source: 00000000-00007376.00000000.113264.72F31000.00000020.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type " in Source: 00000000-00007376.00000000.113264.72F31000.00000020.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types" in Source: 00000000-00007376.00000000.113264.72F31000.00000020.mdmp "SOFTWARE\Microsoft\Cryptography\Providers\Type " in Source: 00000000-00007376.00000000.113264.72F31000.00000020.mdmp "SOFTWARE\Microsoft\SystemCertificates\Root\Certificates\2BD63D28D7BCD0E251195AEB519243C13142EBC3" in Source: 00000000-00007376.00000000.113264.72F31000.00000020.mdmp "SOFTWARE\Microsoft\SystemCertificates\Root\Certificates\8A334AA8052DD244A647306A76B8178FA215F344" in Source: 00000000-00007376.00000000.113264.72F31000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\Print" in Source: 00000000-00007376.00000000.113264.73051000.00000020.mdmp "System\CurrentControlSet\Control\Print" in Source: 00000000-00007376.00000000.113264.73051000.00000020.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00007376.00000000.113264.73051000.00000020.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00007376.00000000.113264.73051000.00000020.mdmp "System\CurrentControlSet\Control\Print\Environments" in Source: 00000000-00007376.00000000.113264.73051000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib" in Source: 00000000-00007376.00000000.113264.73051000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "SOFTWARE\CLASSES\PACKAGEDCOM\PACKAGE" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "SOFTWARE\Microsoft\Office\16.0" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "SOFTWARE\Wow6432Node\Microsoft\Office\16.0" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCU\%s\COMMON\GENERAL" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\%s\COMMON\InstallRoot" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCU\%s\%s" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\%s\%s\InstallRoot" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCU\SOFTWARE\Classes\%s.Application\CurVer" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCU\SOFTWARE\Classes\%s.Application.%s" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\%s.Application\CurVer" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\%s.Application.%s" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\%s.Application\CurVer" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\%s.Application.%s" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\%s\%s" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\%s\LocalServer" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\%s\LocalServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\%s\LocalServer" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\%s\LocalServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\WOW6432Node\CLSID\%s\LocalServer" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\WOW6432Node\CLSID\%s\LocalServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "\Registry\Machine\Software\Classes\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Classes\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "\Registry\Machine\System\ControlSet001\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\Excel.Application\CLSID" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\WOW6432Node\CLSID\{00024500-0000-0000-C000-000000000046}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\WOW6432Node\CLSID\{00024500-0000-0000-C000-000000000046}\Implemented Categories" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\WOW6432Node\CLSID\{00024500-0000-0000-C000-000000000046}\Implemented Categories\{000C0118-0000-0000-C000-000000000046}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\WOW6432Node\CLSID\{00024500-0000-0000-C000-000000000046}\InprocHandler32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\WOW6432Node\CLSID\{00024500-0000-0000-C000-000000000046}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\WOW6432Node\CLSID\{00024500-0000-0000-C000-000000000046}\InprocServer32\15.0.0.0" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\WOW6432Node\CLSID\{00024500-0000-0000-C000-000000000046}\LocalServer" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\WOW6432Node\CLSID\{00024500-0000-0000-C000-000000000046}\LocalServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\WOW6432Node\CLSID\{00024500-0000-0000-C000-000000000046}\ProgID" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\WOW6432Node\CLSID\{00024500-0000-0000-C000-000000000046}\VersionIndependentProgID" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\Excel.Application\CLSID" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{00024500-0000-0000-C000-000000000046}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{00024500-0000-0000-C000-000000000046}\Implemented Categories" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{00024500-0000-0000-C000-000000000046}\Implemented Categories\{000C0118-0000-0000-C000-000000000046}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{00024500-0000-0000-C000-000000000046}\InprocHandler32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{00024500-0000-0000-C000-000000000046}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{00024500-0000-0000-C000-000000000046}\InprocServer32\15.0.0.0" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{00024500-0000-0000-C000-000000000046}\LocalServer" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{00024500-0000-0000-C000-000000000046}\LocalServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{00024500-0000-0000-C000-000000000046}\ProgID" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{00024500-0000-0000-C000-000000000046}\VersionIndependentProgID" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\Outlook.Application" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\Outlook.Application\CLSID" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCU\SOFTWARE\Classes\Outlook.Application" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCU\SOFTWARE\Classes\Outlook.Application\CLSID" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\Interface\{00063001-0000-0000-C000-000000000046}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\Interface\{00063001-0000-0000-C000-000000000046}\ProxyStubClsid" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\Interface\{00063001-0000-0000-C000-000000000046}\ProxyStubClsid32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\Interface\{00063001-0000-0000-C000-000000000046}\TypeLib" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\Interface\{00063001-0000-0000-C000-000000000046}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\Interface\{00063001-0000-0000-C000-000000000046}\ProxyStubClsid" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\Interface\{00063001-0000-0000-C000-000000000046}\ProxyStubClsid32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\Interface\{00063001-0000-0000-C000-000000000046}\TypeLib" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCU\SOFTWARE\Classes\Interface\{00063001-0000-0000-C000-000000000046}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCU\SOFTWARE\Classes\Interface\{00063001-0000-0000-C000-000000000046}\ProxyStubClsid" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCU\SOFTWARE\Classes\Interface\{00063001-0000-0000-C000-000000000046}\ProxyStubClsid32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCU\SOFTWARE\Classes\Interface\{00063001-0000-0000-C000-000000000046}\TypeLib" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Microsoft\Office\16.0\Outlook" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\16.0\Outlook" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Clients\Mail\Microsoft Outlook" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{91493441-5A91-11CF-8700-00AA0060263B}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{91493441-5A91-11CF-8700-00AA0060263B}\InprocServer32\15.0.0.0" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\PowerPoint.Application\CLSID" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\WOW6432Node\CLSID\{91493441-5A91-11CF-8700-00AA0060263B}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\WOW6432Node\CLSID\{91493441-5A91-11CF-8700-00AA0060263B}\InprocHandler" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\WOW6432Node\CLSID\{91493441-5A91-11CF-8700-00AA0060263B}\InprocHandler32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\WOW6432Node\CLSID\{91493441-5A91-11CF-8700-00AA0060263B}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\WOW6432Node\CLSID\{91493441-5A91-11CF-8700-00AA0060263B}\InprocServer32\15.0.0.0" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\WOW6432Node\CLSID\{91493441-5A91-11CF-8700-00AA0060263B}\LocalServer" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\WOW6432Node\CLSID\{91493441-5A91-11CF-8700-00AA0060263B}\LocalServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\WOW6432Node\CLSID\{91493441-5A91-11CF-8700-00AA0060263B}\ProgID" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\WOW6432Node\CLSID\{91493441-5A91-11CF-8700-00AA0060263B}\VersionIndependentProgID" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\CLSID\{91493441-5A91-11CF-8700-00AA0060263B}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\CLSID\{91493441-5A91-11CF-8700-00AA0060263B}\InprocServer32\15.0.0.0" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\PowerPoint.Application\CLSID" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{91493441-5A91-11CF-8700-00AA0060263B}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{91493441-5A91-11CF-8700-00AA0060263B}\InprocHandler" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{91493441-5A91-11CF-8700-00AA0060263B}\InprocHandler32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{91493441-5A91-11CF-8700-00AA0060263B}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{91493441-5A91-11CF-8700-00AA0060263B}\InprocServer32\15.0.0.0" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{91493441-5A91-11CF-8700-00AA0060263B}\LocalServer" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{91493441-5A91-11CF-8700-00AA0060263B}\LocalServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{91493441-5A91-11CF-8700-00AA0060263B}\ProgID" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{91493441-5A91-11CF-8700-00AA0060263B}\VersionIndependentProgID" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\Word.Application\CLSID" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\WOW6432Node\CLSID\{000209FF-0000-0000-C000-000000000046}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\WOW6432Node\CLSID\{000209FF-0000-0000-C000-000000000046}\InprocHandler32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\WOW6432Node\CLSID\{000209FF-0000-0000-C000-000000000046}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\WOW6432Node\CLSID\{000209FF-0000-0000-C000-000000000046}\InprocServer32\15.0.0.0" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\WOW6432Node\CLSID\{000209FF-0000-0000-C000-000000000046}\LocalServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\WOW6432Node\CLSID\{000209FF-0000-0000-C000-000000000046}\ProgID" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\WOW6432Node\CLSID\{000209FF-0000-0000-C000-000000000046}\VersionIndependentProgID" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\Word.Application\CLSID" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{000209FF-0000-0000-C000-000000000046}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{000209FF-0000-0000-C000-000000000046}\InprocHandler32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{000209FF-0000-0000-C000-000000000046}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{000209FF-0000-0000-C000-000000000046}\InprocServer32\15.0.0.0" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{000209FF-0000-0000-C000-000000000046}\LocalServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{000209FF-0000-0000-C000-000000000046}\ProgID" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{000209FF-0000-0000-C000-000000000046}\VersionIndependentProgID" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "System\CurrentControlSet" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "SOFTWARE\Classes\CLSID\%ls\LocalServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "SOFTWARE\Classes\CLSID" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCU\Software\Classes\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "Software\Classes\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCC\System\CurrentControlSet\Control\Print\Printers" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Microsoft\Direct3D" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "Software\Classes\Body5\Open\Shell\Command" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Encore Software\Middle School Advantage 2001\1.0" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\nowcom" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCU\Software\nowcom" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\nowirc" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCU\Software\nowirc" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\nownuri" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCU\Software\nownuri" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Microsoft\MSN" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\MSN" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Config\0001\Display\Settings" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "System\CurrentControlSet\Enum" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\System\CurrentControlSet\Enum" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCU\Software\Microsoft\CTF\LangBar" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\ODBC" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\System\CurrentControlSet\services\W3svc\Parameters" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Microsoft\Outlook Express\Inetcomm" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Microsoft\Outlook Express\Version Info" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{4CB63E61-C611-11D0-83AA-000092900184}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{4CB63E61-C611-11D0-83AA-000092900184}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{4CB63E61-C611-11D0-83AA-000092900184}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{4CB63E62-C611-11D0-83AA-000092900184}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{4CB63E62-C611-11D0-83AA-000092900184}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{B4CA2970-DD2B-11D0-9DFA-00AA00AF3494}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{B4CA2970-DD2B-11D0-9DFA-00AA00AF3494}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{B4CA2970-DD2B-11D0-9DFA-00AA00AF3494}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{B4CA2971-DD2B-11D0-9DFA-00AA00AF3494}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{B4CA2971-DD2B-11D0-9DFA-00AA00AF3494}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{C83B5610-E0DF-11D0-9E00-00AA00AF3494}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{C83B5610-E0DF-11D0-9E00-00AA00AF3494}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Microsoft\Windows NT\CurrentVersion\drivers.desc" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{31345649-0000-0010-8000-00AA00389B71}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{31345649-0000-0010-8000-00AA00389B71}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{31345649-0000-0010-8000-00AA00389B71}\Pins\Input" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{31345649-0000-0010-8000-00AA00389B71}\Pins\Input\Types\{73646976-0000-0010-8000-00AA00389B71}\{31345649-0000-0010-8000-00AA00389B71}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{31345649-0000-0010-8000-00AA00389B71}\Pins\Output" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{31345649-0000-0010-8000-00AA00389B71}\Pins\Output\Types\{73646976-0000-0010-8000-00AA00389B71}\{00000000-0000-0000-0000-000000000000}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{87CA6F02-49E4-11CF-A3FE-00AA003735BE}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{87CA6F02-49E4-11CF-A3FE-00AA003735BE}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{87CA6F04-49E4-11CF-A3FE-00AA003735BE}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{87CA6F04-49E4-11CF-A3FE-00AA003735BE}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{A2551F60-705F-11CF-A424-00AA003735BE}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{A2551F60-705F-11CF-A424-00AA003735BE}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{A2551F60-705F-11CF-A424-00AA003735BE}\Pins\Input" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{A2551F60-705F-11CF-A424-00AA003735BE}\Pins\Input\Types\{73646976-0000-0010-8000-00AA00389B71}\{00000000-0000-0000-0000-000000000000}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{A2551F60-705F-11CF-A424-00AA003735BE}\Pins\Output" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{A2551F60-705F-11CF-A424-00AA003735BE}\Pins\Output\Types\{73646976-0000-0010-8000-00AA00389B71}\{31345649-0000-0010-8000-00AA00389B71}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{BD323430-CE94-11CE-82DD-0800095A5B55}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{BD323430-CE94-11CE-82DD-0800095A5B55}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{BD323431-CE94-11CE-82DD-0800095A5B55}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{BD323431-CE94-11CE-82DD-0800095A5B55}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{BD323432-CE94-11CE-82DD-0800095A5B55}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{BD323432-CE94-11CE-82DD-0800095A5B55}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{BD323433-CE94-11CE-82DD-0800095A5B55}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{BD323433-CE94-11CE-82DD-0800095A5B55}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\Filter\{31345649-0000-0010-8000-00AA00389B71}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\Filter\{A2551F60-705F-11CF-A424-00AA003735BE}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCU\Software\Intel\Indeo\4.1" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{1F73E9B1-8C3A-11D0-A3BE-00A0C9244436}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{30355649-0000-0010-8000-00AA00389B71}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{1F73E9B1-8C3A-11D0-A3BE-00A0C9244436}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{1F73E9B1-8C3A-11D0-A3BE-00A0C9244436}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{2DE89781-DBF6-11D0-A30E-444553540000}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{2DE89781-DBF6-11D0-A30E-444553540000}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{30355649-0000-0010-8000-00AA00389B71}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{30355649-0000-0010-8000-00AA00389B71}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{33D9A760-90C8-11D0-BD43-00A0C911CE86}\Instance\Indeo" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{665A4443-D905-11D0-A30E-444553540000}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{665A4443-D905-11D0-A30E-444553540000}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{665A4444-D905-11D0-A30E-444553540000}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{665A4444-D905-11D0-A30E-444553540000}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{665A4445-D905-11D0-A30E-444553540000}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{665A4445-D905-11D0-A30E-444553540000}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{665A4448-D905-11D0-A30E-444553540000}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{665A4448-D905-11D0-A30E-444553540000}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{665A444A-D905-11D0-A30E-444553540000}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{665A444A-D905-11D0-A30E-444553540000}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{84725EA1-2FBC-11D1-BC86-00A0C969FC67}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{84725EA1-2FBC-11D1-BC86-00A0C969FC67}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{C1C0FE00-F3C2-11D0-91D4-444553540000}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{C1C0FE00-F3C2-11D0-91D4-444553540000}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{E369A160-F3C2-11D0-91D4-444553540000}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{E369A160-F3C2-11D0-91D4-444553540000}\InprocServer32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\Interface\{665A4447-D905-11D0-A30E-444553540000}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\Interface\{665A4447-D905-11D0-A30E-444553540000}\ProxyStubClsid" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\Interface\{665A4447-D905-11D0-A30E-444553540000}\ProxyStubClsid32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\Interface\{665A4447-D905-11D0-A30E-444553540000}\TypeLib" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\Interface\{665A4449-D905-11D0-A30E-444553540000}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\Interface\{665A4449-D905-11D0-A30E-444553540000}\ProxyStubClsid" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\Interface\{665A4449-D905-11D0-A30E-444553540000}\ProxyStubClsid32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\Interface\{665A4449-D905-11D0-A30E-444553540000}\TypeLib" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\TypeLib\{665A4446-D905-11D0-A30E-444553540000}\1.0" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\TypeLib\{665A4446-D905-11D0-A30E-444553540000}\1.0\0\win32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\TypeLib\{665A4446-D905-11D0-A30E-444553540000}\1.0\FLAGS" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\TypeLib\{665A4446-D905-11D0-A30E-444553540000}\1.0\HELPDIR" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCU\Software\Classes\iTunes.BurnCD" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\iTunes.BurnCD" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCU\Software\Classes\MIME\Database\Content Type\application/x-itunes-itms" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\MIME\Database\Content Type\application/x-itunes-itms" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCU\Software\Classes\MIME\Database\Content Type\application/x-itunes-itpc" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\MIME\Database\Content Type\application/x-itunes-itpc" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCU\Software\Classes\MIME\Database\Content Type\application/x-podcast" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\MIME\Database\Content Type\application/x-podcast" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SYSTEM\ControlSet001\Control\ProductOptions" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SYSTEM\ControlSet002\Control\ProductOptions" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SYSTEM\ControlSet003\Control\ProductOptions" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\chm.file\shell\open\command" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\software\microsoft\IE Setup\SETUP" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\software\microsoft\Windows NT\CurrentVersion\Hotfix\ " in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SYSTEM\WPA\MediaCenter" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\software\microsoft\Outlook Express" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Microsoft\Direct3D" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Microsoft\DirectDraw" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCU\Software\Microsoft\Windows\CurrentVersion\ThemeManager" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Microsoft\WAB\DLLPath" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCU\Software\Microsoft\Direct3D" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Microsoft\Internet Explorer\Version Vector" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Client" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Macromedia\FlashPlayerActiveY_BOGUSKEY" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Macromedia\FlashPlayerActiveX" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\CLSID\{031E4825-7B94-4dc3-B131-E946B44C8DD5}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Wow6432Node\Microsoft\NET Framework Setup\NDP\v4\Client" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Wow6432Node\Microsoft\NET Framework Setup\NDP\v4\Full" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Wow6432Node\Microsoft\Internet Explorer" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Microsoft\Windows\CurrentVersion\Controls Folder\Desk" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Microsoft\Windows\CurrentVersion\Controls Folder\Display" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\System\CurrentControlSet\Control\Class" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\System\CurrentControlSet\Services\Class" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\System\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\System\CurrentControlSet\Services\Class\Display" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Special Paths\Cookies" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "SOFTWARE\Hasbro Interactive" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SYSTEM\CurrentControlSet\Enum" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Enum" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "SYSTEM\CurrentControlSet\Enum\PCI" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCC\Software\Fonts" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "System\CurrentControlSet\Control\Nls\Locale" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\WORDPAD.EXE" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\rtffile\shell\open\command" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\rtffile\shell\print\command" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\rtffile\shell\printto\command" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\Wordpad.Document.1\shell\open\command" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\Wordpad.Document.1\shell\print\command" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\Wordpad.Document.1\shell\printto\command" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\wrifile\shell\open\command" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\wrifile\shell\print\command" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCR\wrifile\shell\printto\command" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Classes\Applications\wordpad.exe\shell\open\command" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Classes\Applications\wordpad.exe\shell\print\command" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Classes\Applications\wordpad.exe\shell\printto\command" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Classes\rtffile\shell\open\command" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Classes\rtffile\shell\print\command" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Classes\rtffile\shell\printto\command" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Classes\Wordpad.Document.1\shell\open\command" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Classes\Wordpad.Document.1\shell\print\command" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Classes\Wordpad.Document.1\shell\printto\command" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Classes\wrifile\shell\open\command" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Classes\wrifile\shell\print\command" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Classes\wrifile\shell\printto\command" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Microsoft\Windows\CurrentVersion\Setup" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "System\CurrentControlSet\Services\NetBT" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "Software\Microsoft\Windows NT\CurrentVersion\NetworkCards" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\System\CurrentControlSet\Control\Windows" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Microsoft\DirectX" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\DXDIAG.EXE" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Electronic Arts\Future Cop\Settings" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Drivers32" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\System\CurrentControlSet\Control\MediaResources\ACM\MSACM.MSADPCM" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Microsoft\Windows" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCU\Software\Microsoft\Windows" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "Software\FirstByte\ProVoice\SpeechFonts" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Microsoft\Internet Explorer" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "System\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\OEM" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCU\Software\Adobe" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Adobe" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Adobe\PageMaker65" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCU\Software\Adobe\PageMaker65" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKCU\Software\Caere Corp\PageKeepPro30\Preference" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "Software\Caere Corp\Scan Manager\4.02\Scanners" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SYSTEM\CurrentControlSet\Enum\Root" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Installer\UserData\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Components\359E92CC2CB71D119A12000A9CE1A22A" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\System\CurrentControlSet\Services\W3SVC\Parameters" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\System\CurrentControlSet\Control\MediaResources\DirectSound\Application Compatibility" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "\Registry\Machine\SOFTWARE\Policies\Microsoft\Windows NT\Windows File Protection" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "\Registry\HKEY_CURRENT_USER\Software\Classes\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "Software\Volatile\00" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy" in Source: 00000000-00007376.00000000.113264.73451000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Lsa" in Source: 00000000-00007376.00000000.113264.73451000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Accent" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp "Software\Policies\Microsoft\Windows\Personalization" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp "Software\Microsoft\Windows\DWM" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\ImmersiveShell" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\ThemeManager" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\DiagnosticAnimationXML" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp ".Default\Software\Microsoft\Windows\CurrentVersion\ThemeManager" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Themes\History\Colors" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Themes\History" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Accents" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp "Software\Microsoft\Wisp\Touch" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp "\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp "\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp "\Software\Classes\CLSID\" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\ProfileList" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp "\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp "\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Disable8And16BitMitigation" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Wow64\" in Source: 00000000-00007376.00000000.113264.74624000.00000002.mdmp "\REGISTRY\MACHINE\SOFTWARE\Wow6432Node" in Source: 00000000-00007376.00000000.113264.74624000.00000002.mdmp "\REGISTRY\USER\*\SOFTWARE\Classes" in Source: 00000000-00007376.00000000.113264.74624000.00000002.mdmp "\REGISTRY\USER\*\SOFTWARE\Classes\Wow6432Node" in Source: 00000000-00007376.00000000.113264.74624000.00000002.mdmp "system\CurrentControlSet\Control\NetworkProvider" in Source: 00000000-00007376.00000000.113264.746E1000.00000020.mdmp "system\CurrentControlSet\control\NetworkProvider\ProviderOrder" in Source: 00000000-00007376.00000000.113264.746E1000.00000020.mdmp "system\CurrentControlSet\control\NetworkProvider\HwOrder" in Source: 00000000-00007376.00000000.113264.746E1000.00000020.mdmp "system\CurrentControlSet" in Source: 00000000-00007376.00000000.113264.746E1000.00000020.mdmp "system\CurrentControlSet\Control\NetworkProvider\Notifyees" in Source: 00000000-00007376.00000000.113264.746E1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00007376.00000000.113264.746E1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Network" in Source: 00000000-00007376.00000000.113264.746E1000.00000020.mdmp "SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\" in Source: 00000000-00007376.00000000.113264.74701000.00000020.mdmp "SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\Interfaces\" in Source: 00000000-00007376.00000000.113264.74701000.00000020.mdmp "SYSTEM\CurrentControlSet\Services\NetBT\Parameters" in Source: 00000000-00007376.00000000.113264.74701000.00000020.mdmp "System\CurrentControlSet\Services\NcbService\NCB" in Source: 00000000-00007376.00000000.113264.74701000.00000020.mdmp "Software\Microsoft\wcmsvc\wifinetworkmanager\config" in Source: 00000000-00007376.00000000.113264.74701000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0" in Source: 00000000-00007376.00000000.113264.74741000.00000020.mdmp "System\CurrentControlSet\Control\SecurityProviders" in Source: 00000000-00007376.00000000.113264.74741000.00000020.mdmp "System\CurrentControlSet\Control\Lsa\SspiCache" in Source: 00000000-00007376.00000000.113264.74741000.00000020.mdmp "System\CurrentControlSet\Control\SecurityProviders\SaslProfiles" in Source: 00000000-00007376.00000000.113264.74741000.00000020.mdmp "System\CurrentControlSet\Control\Lsa" in Source: 00000000-00007376.00000000.113264.74741000.00000020.mdmp "System\CurrentControlSet\Control\Hvsi" in Source: 00000000-00007376.00000000.113264.74741000.00000020.mdmp "SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\GpParameters" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp "SYSTEM\CurrentControlSet\Services\Netlogon\Parameters" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp "\REGISTRY\MACHINE\SYSTEM\CurrentControlSet\Services" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp "Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp "\Software\Policies\Microsoft\Windows\Safer" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp "System\CurrentControlSet\Control\IDConfigDB" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp "\Registry\Machine\Software\Classes" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp "System\CurrentControlSet\Control\LSA\AccessProviders" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Srp\GP\" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Group Policy\Appmgmt" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Diagnostics" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\SrpExtensionConfig" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp "%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRoot%" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp "%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir%" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp "System\CurrentControlSet\Services\" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp "\REGISTRY\MACHINE\SOFTWARE\CLASSES" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp "Software\Classes\" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\Lsa" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\DevQuery" in Source: 00000000-00007376.00000000.113264.74801000.00000020.mdmp "SYSTEM\CurrentControlSet\Services\DeviceInstall\Parameters" in Source: 00000000-00007376.00000000.113264.74801000.00000020.mdmp "SYSTEM\CurrentControlSet\Services\DeviceInstall" in Source: 00000000-00007376.00000000.113264.74801000.00000020.mdmp "System\CurrentControlSet\Control\IDConfigDB" in Source: 00000000-00007376.00000000.113264.74801000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Setup" in Source: 00000000-00007376.00000000.113264.74801000.00000020.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes" in Source: 00000000-00007376.00000000.113264.74801000.00000020.mdmp "\REGISTRY\MACHINE\SYSTEM\CurrentControlSet\Hardware Profiles\Current" in Source: 00000000-00007376.00000000.113264.74801000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\Cryptography\ECCParameters" in Source: 00000000-00007376.00000000.113264.74841000.00000020.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Policies\Microsoft\Cryptography\Configuration" in Source: 00000000-00007376.00000000.113264.74841000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Lsa" in Source: 00000000-00007376.00000000.113264.74841000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy" in Source: 00000000-00007376.00000000.113264.74841000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00007376.00000000.113264.749F1000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00007376.00000000.113264.749F1000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00007376.00000000.113264.749F1000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout\" in Source: 00000000-00007376.00000000.113264.749F1000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layouts\" in Source: 00000000-00007376.00000000.113264.749F1000.00000020.mdmp "\Registry\Machine\Software\Policies\Microsoft\Windows\Display" in Source: 00000000-00007376.00000000.113264.749F1000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows\Tablet PC\" in Source: 00000000-00007376.00000000.113264.749F1000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\Media Center\" in Source: 00000000-00007376.00000000.113264.749F1000.00000020.mdmp "Software\Policies\Microsoft\Windows NT\Reliability" in Source: 00000000-00007376.00000000.113264.749F1000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\ImmersiveShell\" in Source: 00000000-00007376.00000000.113264.749F1000.00000020.mdmp "System\CurrentControlSet\Services" in Source: 00000000-00007376.00000000.113264.74B71000.00000020.mdmp "SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\GpParameters" in Source: 00000000-00007376.00000000.113264.74B71000.00000020.mdmp "SYSTEM\CurrentControlSet\Services\Netlogon\Parameters" in Source: 00000000-00007376.00000000.113264.74B71000.00000020.mdmp "Software\Microsoft\IdentityStore\Providers" in Source: 00000000-00007376.00000000.113264.74B71000.00000020.mdmp "\REGISTRY\MACHINE\Software\Microsoft\SecurityManager\TransientObjects\" in Source: 00000000-00007376.00000000.113264.74B71000.00000020.mdmp "System\CurrentControlSet\Control\SQMServiceList" in Source: 00000000-00007376.00000000.113264.74B71000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00007376.00000000.113264.74B71000.00000020.mdmp "System\CurrentControlSet\Control" in Source: 00000000-00007376.00000000.113264.74B71000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\WMI\Security" in Source: 00000000-00007376.00000000.113264.74B71000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\Lsa" in Source: 00000000-00007376.00000000.113264.74B71000.00000020.mdmp "System\CurrentControlSet\Services\WinSock2\Parameters" in Source: 00000000-00007376.00000000.113264.74BC1000.00000020.mdmp "System\CurrentControlSet\Services\Winsock2\Parameters" in Source: 00000000-00007376.00000000.113264.74BC1000.00000020.mdmp "System\CurrentControlSet\Services\Tcpip\Parameters" in Source: 00000000-00007376.00000000.113264.74BC1000.00000020.mdmp "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\WinSock2\Parameters" in Source: 00000000-00007376.00000000.113264.74BC1000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Services\WS2IFSL" in Source: 00000000-00007376.00000000.113264.74BC1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\FileAssociation" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\LowRegistry\DontShowMeThisDialogAgain" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\DontShowMeThisDialogAgain" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp "Software\Microsoft\Windows\Shell" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp "Software\Microsoft\Windows\Shell\MuiCache" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp "Software\classes" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp "Software\Classes\Applications\%s" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp "Software\Classes\Applications" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp "Software\Clients\%s" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp "Software\Clients\%s\%s" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp "Software\Classes\" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp "SOFTWARE\Microsoft\Internet Explorer" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp "Software\Microsoft\Windows NT\Current Version" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp "SOFTWARE\Microsoft\Internet Explorer\Registration" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp "Software\Microsoft\Internet Explorer\TypedURLs" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\DeskView" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp "Software\Policies" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp "Software\Policies\" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp "Software\Policies\Microsoft\Internet Explorer" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0" in Source: 00000000-00007376.00000000.113264.74E31000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback" in Source: 00000000-00007376.00000000.113264.74E31000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink" in Source: 00000000-00007376.00000000.113264.74E31000.00000020.mdmp "\Registry\Machine\SOFTWARE\Policies\Microsoft\Windows NT\Printers" in Source: 00000000-00007376.00000000.113264.74E31000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize" in Source: 00000000-00007376.00000000.113264.74E31000.00000020.mdmp "\REGISTRY\MACHINE\SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00007376.00000000.113264.74E31000.00000020.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Type 1 Installer\Type 1 Fonts" in Source: 00000000-00007376.00000000.113264.74E31000.00000020.mdmp "System\CurrentControlSet\Control\Power\User\Default\PowerSchemes" in Source: 00000000-00007376.00000000.113264.76371000.00000020.mdmp "System\CurrentControlSet\Control\Power\PowerSettings" in Source: 00000000-00007376.00000000.113264.76371000.00000020.mdmp "System\CurrentControlSet\Control\Power\User\PowerSchemes" in Source: 00000000-00007376.00000000.113264.76371000.00000020.mdmp "System\CurrentControlSet\Policies\Microsoft\PortableOperatingSystem" in Source: 00000000-00007376.00000000.113264.76371000.00000020.mdmp "System\CurrentControlSet\Services\NDIS\Parameters" in Source: 00000000-00007376.00000000.113264.76371000.00000020.mdmp "System\CurrentControlSet\Control\Power\ModernSleep" in Source: 00000000-00007376.00000000.113264.76371000.00000020.mdmp "Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00007376.00000000.113264.76371000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\" in Source: 00000000-00007376.00000000.113264.76501000.00000020.mdmp "System\CurrentControlSet\Control\Hvsi" in Source: 00000000-00007376.00000000.113264.76501000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\FCM\Impolite" in Source: 00000000-00007376.00000000.113264.76501000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\%s" in Source: 00000000-00007376.00000000.113264.76501000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\%s" in Source: 00000000-00007376.00000000.113264.76501000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\QfePolicyDefinitions\%s\%s" in Source: 00000000-00007376.00000000.113264.76501000.00000020.mdmp "Software\Policies\Microsoft\Windows" in Source: 00000000-00007376.00000000.113264.76501000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies" in Source: 00000000-00007376.00000000.113264.76501000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\FileInUseResolver" in Source: 00000000-00007376.00000000.113264.76501000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" in Source: 00000000-00007376.00000000.113264.76501000.00000020.mdmp "Unable to create RegKey HKLM\%ws" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp "software\microsoft\windows\currentversion\setup\PnpLockdownFiles" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Setup" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp "Software\Microsoft\EmbeddedNT\Security" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp "\REGISTRY\MACHINE\SYSTEM\CurrentControlSet\Hardware Profiles\Current" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\MediaResources" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp "System\CurrentControlSet\Enum" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp "System\CurrentControlSet\Control\Wmi\Security" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp "System\CurrentControlSet\Control\GroupOrderList" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp "System\CurrentControlSet\Services" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp "MACHINE\software\microsoft\windows\currentversion\setup\PnpLockdownFiles" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp "software\microsoft\windows\currentversion\setup\PnpResources" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp "MACHINE\software\microsoft\windows\currentversion\setup\PnpResources" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp "software\Policies\microsoft\windows\PnpLockdown" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Setup" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp "Software\Policies\Microsoft\Windows\DeviceInstall" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Device Installer" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp "System\CurrentControlSet\Control" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp "Software\Microsoft\Rpc\SecurityService" in Source: 00000000-00007376.00000000.113264.76D71000.00000020.mdmp "Software\Microsoft\Rpc" in Source: 00000000-00007376.00000000.113264.76D71000.00000020.mdmp "System\CurrentControlSet\Services\Rpc\Linkage" in Source: 00000000-00007376.00000000.113264.76D71000.00000020.mdmp "System\CurrentControlSet\Services\Rpc" in Source: 00000000-00007376.00000000.113264.76D71000.00000020.mdmp "Software\Policies\Microsoft\Windows NT\Rpc" in Source: 00000000-00007376.00000000.113264.76D71000.00000020.mdmp "\REGISTRY\MACHINE\Software\Microsoft\Rpc\Extensions" in Source: 00000000-00007376.00000000.113264.76D71000.00000020.mdmp "System\CurrentControlSet\Control\SecurityProviders" in Source: 00000000-00007376.00000000.113264.76D71000.00000020.mdmp "System\CurrentControlSet\Control\Keyboard Layouts" in Source: 00000000-00007376.00000000.113264.76E31000.00000020.mdmp "SOFTWARE\Microsoft\OLEAUT" in Source: 00000000-00007376.00000000.113264.76E61000.00000020.mdmp "SOFTWARE\Microsoft\OLEAUT\UserEra" in Source: 00000000-00007376.00000000.113264.76E61000.00000020.mdmp "Software\Microsoft\OleAut" in Source: 00000000-00007376.00000000.113264.76E61000.00000020.mdmp "Software\classes" in Source: 00000000-00007376.00000000.113264.76E61000.00000020.mdmp "Software\Microsoft\Windows NT\CurrentVersion\ProfileList" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp "\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp "\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp "Software\Microsoft\Windows NT\CurrentVersion\ProfileList\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp "System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp "s\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp "Software\Microsoft\Command Processor" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp "Software\Microsoft\CTF" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp "Software\Microsoft\Internet Explorer" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\AppHost" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\ClosedCaptioning" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Shell Extensions" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Themes" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\WinTrust" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp "Software\Microsoft\Windows\Windows Error Reporting" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp "Software\Microsoft\Windows NT" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp "Software\Microsoft\Windows NT\CurrentVersion\ICM" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp "Software\Microsoft\Wisp" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp "Software\Policies" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp "Software\Microsoft" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp "Software\Microsoft\Windows" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Holographic" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp "Software\Microsoft\SystemCertificates" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp "Software\Microsoft\Speech_OneCore" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp "Software\Microsoft\Speech" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp "Software\Microsoft\Speech Virtual" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\AppCertDlls" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp "\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\WOW" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp "\Registry\MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp "\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Quirks" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp "\Registry\Machine\System\CurrentControlSet\Control\NLS\Language" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\CallbackDlls" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Nls\Sorting\Ids" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp "\Registry\Machine\Software\Microsoft\Windows\Containers" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp "\Registry\Machine\System\CurrentControlSet\Services\LanmanServer\Parameters" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp "\Registry\Machine\System\CurrentControlSet\Services\DnsCache\Parameters" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ComputerName" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\WinInit" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Terminal Server\Compatibility\Applications\" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp "\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp "\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\AppCompat" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp "\REGISTRY\MACHINE\SYSTEM\CurrentControlSet\Control\WOW" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebug" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebugProtected" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebug\AutoExclusionList" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebugProtected\AutoExclusionList" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp "\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ComputerName\ComputerName" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp "\Registry\Machine\System\CurrentControlSet\Services\Tcpip\Parameters" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp "Software\Microsoft\StorageLibrary\ChangeTracking\%s\%d" in Source: 00000000-00007376.00000000.113264.77756000.00000004.mdmp "Software\Classes" in Source: 00000000-00007376.00000000.113264.777D1000.00000020.mdmp "SOFTWARE\Microsoft\Ole\Extensions" in Source: 00000000-00007376.00000000.113264.777D1000.00000020.mdmp "\Registry\Machine\Software\Classes\Interface\%s\TypeLib" in Source: 00000000-00007376.00000000.113264.777D1000.00000020.mdmp "\Registry\Machine\Software\Classes\Interface\%s\Forward" in Source: 00000000-00007376.00000000.113264.777D1000.00000020.mdmp "\Registry\Machine\Software\Classes\Interface\{00020400-0000-0000-C000-000000000046}" in Source: 00000000-00007376.00000000.113264.777D1000.00000020.mdmp "\Registry\Machine\Software\Classes\Interface" in Source: 00000000-00007376.00000000.113264.777D1000.00000020.mdmp "Registry\Machine\Software\Classes\" in Source: 00000000-00007376.00000000.113264.777D1000.00000020.mdmp "Software\Microsoft\Ole" in Source: 00000000-00007376.00000000.113264.777D1000.00000020.mdmp "\Registry\Machine\Software\Classes\TypeLib\%s" in Source: 00000000-00007376.00000000.113264.777D1000.00000020.mdmp "Software\Microsoft\OLE\Tracing" in Source: 00000000-00007376.00000000.113264.777D1000.00000020.mdmp "Software\Microsoft\Ole\AppCompat" in Source: 00000000-00007376.00000000.113264.777D1000.00000020.mdmp "Software\Microsoft\OLE2\UnknownUserType" in Source: 00000000-00007376.00000000.113264.777D1000.00000020.mdmp "Software\Microsoft\OLE2\DefaultIconLabel" in Source: 00000000-00007376.00000000.113264.777D1000.00000020.mdmp "Software\Microsoft\OLE1\UnregisteredVerb" in Source: 00000000-00007376.00000000.113264.777D1000.00000020.mdmp "Software\Microsoft\OLE" in Source: 00000000-00007376.00000000.113264.777D1000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00007376.00000000.113264.777D1000.00000020.mdmp "Software\Microsoft\Internet Explorer\International" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\URL\Prefixes" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange\PackageList\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "Software\Policies\Microsoft\Control Panel\International\Calendars\TwoDigitYearMax" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ComputerName\ActiveComputerName" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "\Registry\Machine\Software\Policies\Microsoft\System\DNSclient" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\MUI\StringCacheSettings" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "Software\Classes\Local Settings\MuiCache" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Services\Tcpip\Parameters" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "\Registry\Machine\Software\Classes" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "\Registry\Machine\SOFTWARE\Policies\Microsoft\Windows\Appx" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Session Manager" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\AppModel\Origins" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\FileSystem\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "\Registry\Machine\Software\Policies\Microsoft\Windows\System" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Wow64\x86\xtajit" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "Software\Classes\Local Settings\ImmutableMuiCache" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Terminal Server" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Packages" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Families\%s" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Families\%s\%s" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Families" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "HKEY_USERS\...UserSid..." in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "HKEY_USERS\...UserSid...\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Families" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "HKEY_USERS\...UserSid...\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Families\...PackageFamilyName..." in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "HKEY_USERS\...UserSid...\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Families\...family..." in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Packages\Applications" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Packages\Applications\ContentUriRules" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Packages\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "Open:Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\AppX\PackageVolumes\%u" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\AppX" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Mappings" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\AppModel\StateManager" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "Software\Microsoft\Windows NT\CurrentVersion\ProfileList" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "SOFTWARE\Policies\Microsoft\Windows\Appx" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "Software\Policies\Microsoft\Windows\DataCollection" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection\Users" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebug" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebugProtected" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebug\AutoExclusionList" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebugProtected\AutoExclusionList" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ComputerName\ComputerName" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "\REGISTRY\MACHINE\SOFTWARE\CLASSES" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "\REGISTRY\MACHINE\SYSTEM\CURRENTCONTROLSET\HARDWARE PROFILES\CURRENT" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "Software\Classes\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp "\Registry\Machine\Software\Microsoft\SecurityManager\AdminCapabilities" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp "\Registry\Machine\Software\Policies\Microsoft\MUI\Settings" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\NLS\Language" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages\PendingDelete" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp "Software\Policies\Microsoft\Control Panel\Desktop" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp "System\CurrentControlSet\Control\CMF\Config" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp "\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\OEM" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp "\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp "Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp "\Registry\MACHINE\SYSTEM\CurrentControlSet\Control\Nls\CustomLocale" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Srp\GP\DLL" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp ")\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Session Manager\kernel" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp "\Registry\Machine\SOFTWARE\Microsoft\windows nt\CurrentVersion\Image File Execution Options\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Services" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange\PackageList\%ws" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp "\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp "\Registry\Machine\Software\Microsoft\SQMClient\Windows\WMR" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows\Windows Error Reporting\Escalation" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp "\Software\Microsoft\Windows" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\Safe Load Prefixes" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\CMF\SQMData\BootLanguages" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ValidationRunlevels" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager\Segment Heap" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp "System\CurrentControlSet\Control\CMF\LatestIndex" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp9d:T484,"x.exe" file has an entrypoint instructions - "jmp dword ptr [0x10002000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"9e:T484,"x.exe" file has an entrypoint instructions - "jmp dword ptr [0x10002000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"9f:T484,"x.exe" file has an entrypoint instructions - "jmp dword ptr [0x10002000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"a0:T699,Found reference to API "hook_CreateServiceA" (Indicator: "CreateService"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "hook_CreateServiceW" (Indicator: "CreateService"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "CreateServiceA" (Indicator: "CreateService"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.74BC1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "CreateServiceW" (Indicator: "CreateService"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "RtlCreateServiceSid" (Indicator: "CreateService"; Source: "00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp")a1:T1480,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.74768000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "LoadLibraryCWD" (Indicator: "LoadLibrary"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_ForceDXSetupSuccess::APIHook_LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_ForceDXSetupSuccess::APIHook_LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_ForceDXSetupSuccess::APIHook_LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_ForceDXSetupSuccess::APIHook_LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_LoadLibraryCWD::NotifyFn" (Indicator: "LoadLibrary"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_LoadLibraryCWD::InitializeHooksMulti" (Indicator: "LoadLibrary"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp")a2:T752,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")a3:T426,Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.74768000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")a4:T752,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")a5:T426,Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.74768000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")a6:T542,"regsvr32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "regsvr32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "regsvr32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "regsvr32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "regsvr32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "regsvr32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "regsvr32.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "regsvr32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "regsvr32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "regsvr32.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "regsvr32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: ""; Value: "")a7:Ta7d,"regsvr32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "regsvr32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "REGSVR32.EXE"; Value: "") "regsvr32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "regsvr32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "regsvr32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "regsvr32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "regsvr32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "regsvr32.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "regsvr32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "regsvr32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "regsvr32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "regsvr32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "regsvr32.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "regsvr32.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "regsvr32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "regsvr32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "regsvr32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "regsvr32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "regsvr32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "regsvr32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "")a8:T4c2,Found reference to API "hook_WNetGetProviderNameA" (Indicator: "WNetGetProviderName"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "hook_WNetGetProviderNameW" (Indicator: "WNetGetProviderName"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "WNetGetProviderNameA" (Indicator: "WNetGetProviderName"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.746E1000.00000020.mdmp") Found reference to API "WNetGetProviderNameW" (Indicator: "WNetGetProviderName"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.746E1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "WNetGetConnectionW" (Indicator: "WNetGetConnection"; Source: "00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.746E1000.00000020.mdmp, 00000000-00007376.00000000.113264.76501000.00000020.mdmp, 00000000-00007376.00000000.113264.76E61000.00000020.mdmp, 00000000-00007376.00000000.113264.777D1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")a9:T5f4,Found reference to API "hook_GetComputerNameExA" (Indicator: "getcomputernameexa"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "hook_GetComputerNameExW" (Indicator: "getcomputernameexw"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "GetComputerNameExA" (Indicator: "getcomputernameexa"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetComputerNameExW" (Indicator: "getcomputernameexw"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")aa:Te23,Found reference to API "hook_InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "hook_InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "hook_HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "hook_HttpOpenRequestW" (Indicator: "HttpOpenRequest"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "hook_InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74BC1000.00000020.mdmp, 00000000-00007376.00000000.113264.76D71000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")ab:T6cf,Found reference to API "hook_InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "hook_URLDownloadToFileA" (Indicator: "URLDownloadToFile"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "hook_URLDownloadToFileA" (Indicator: "URLDownload"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "hook_URLDownloadToFileW" (Indicator: "URLDownloadToFile"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "hook_URLDownloadToFileW" (Indicator: "URLDownload"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "URLDownloadToFileA" (Indicator: "URLDownloadToFile"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "URLDownloadToFileA" (Indicator: "URLDownload"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "URLDownloadToFileW" (Indicator: "URLDownloadToFile"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "URLDownloadToFileW" (Indicator: "URLDownload"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")ac:T43d,"0.0.0.0" Potential IP "15.0.0.0" found in string "HKCR\WOW6432Node\CLSID\{00024500-0000-0000-C000-000000000046}\InprocServer32\15.0.0.0" Potential IP "15.0.0.0" found in string "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{00024500-0000-0000-C000-000000000046}\InprocServer32\15.0.0.0" Potential IP "15.0.0.0" found in string "HKCR\CLSID\{91493441-5A91-11CF-8700-00AA0060263B}\InprocServer32\15.0.0.0" Potential IP "15.0.0.0" found in string "HKCR\WOW6432Node\CLSID\{91493441-5A91-11CF-8700-00AA0060263B}\InprocServer32\15.0.0.0" Potential IP "15.0.0.0" found in string "HKLM\SOFTWARE\Classes\CLSID\{91493441-5A91-11CF-8700-00AA0060263B}\InprocServer32\15.0.0.0" Potential IP "15.0.0.0" found in string "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{91493441-5A91-11CF-8700-00AA0060263B}\InprocServer32\15.0.0.0" Potential IP "15.0.0.0" found in string "HKCR\WOW6432Node\CLSID\{000209FF-0000-0000-C000-000000000046}\InprocServer32\15.0.0.0" Potential IP "15.0.0.0" found in string "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{000209FF-0000-0000-C000-000000000046}\InprocServer32\15.0.0.0"ad:T5ad3,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007376.00000000.113264.00680000.00000004.mdmp") Found URL "http://https://user" - Source: "00000000-00007376.00000000.113264.73051000.00000020.mdmp") Found URL "http://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsoperationcodeerroroperationcodeerrorspoolerprintereventxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventslabelerrorcodeprinternamestatuslabelerrorcodeprinternamestatusspoolerjobeventxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventslabelerrorcodejobidprinternamestatuslabelerrorcodejobidprinternamestatusspoolergenericeventxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventslabelerrorcodeobjectnamelabelerrorcodeobjectnamesetupparseinfxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventslabelmessageadditionalinfoinfpathdrivernameinstallsectionprocessorarchitecturelasterrorhresultlabelmessageadditionalinfoinfpathdrivernameinstallsectionprocessorarchitecturelasterrorhresultsetupinstallprinterdriverxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventslabelmessageadditionalinfoinfpathdrivernameinstallsectionprocessorarchitecturepackageawarecoredriverdependencieslasterrorhresultlabelmessageadditionalinfoinfpathdrivernameinstallsectionprocessorarchitecturepackageawarecoredriverdependencieslasterrorhresultsetupcopyprinterdriverpackagexmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventslabelmessageadditionalinfoserverinfpathdestinfpathprocessorarchitecturelasterrorhresultlabelmessageadditionalinfoserverinfpathdestinfpathprocessorarchitecturelasterrorhresultsetupprinteroperationxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventscontextmessageadditionalinfoprocessorarchitecturelasterrorhresultcontextmessageadditionalinfoprocessorarchitecturelasterrorhresultsetupv4xmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsdrivernameinfpathrequiredclassdriverhresultdrivernameinfpathrequiredclassdriverhresultsetupunsupportedversionxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsdrivernameinfpathdrivermodelversiondrivernameinfpathdrivermodelversionsetupdirectivevaluexmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsdrivernameinfpathrequiredclassdriverdirectivevaluedrivernameinfpathrequiredclassdriverdirectivevaluesetupforbiddendirectivexmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsdrivernameinfpathrequiredclassdriverdirectiveclassdriveronlynonclassdriveronlydrivernameinfpathrequiredclassdriverdirectiveclassdriveronlynonclassdriveronlysetupmalformeddirectivexmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsdrivernameinfpathrequiredclassdriverdirectiveemptytokenincorrectnumberoftokensdrivernameinfpathrequiredclassdriverdirectiveemptytokenincorrectnumberoftokenssetupinvalidmanifestcountxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsdrivernameinfpathmissingmanifestmultiplemanifestsdrivernameinfpathmissingmanifestmultiplemanifestssetupwfsxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventshresulthresultspoolertracexmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsmessagelasterrormessagelasterrorremotepackagexmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsfunctionerrorserverfunctionerrorserverprintercreatedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1printerdeletedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1printerdeletionpendingxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1printerpausedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1printerunpausedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1printerpurgedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1printersetxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1documentprintedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param4param5param6param7param8param1param2param3param4param5param6param7param8documentpausedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param4param1param2param3param4documentresumedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param4param1param2param3param4documentdeletedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param4param1param2param3param4documentpositionchangedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param4param5param1param2param3param4param5formaddedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1formdeletedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1documenttimeoutxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param4param5param1param2param3param4param5sharefailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param1param2param3unsharefailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param1param2param3driveraddedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param4param1param2param3param4driverdeletedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1driverfailedupgradexmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param1param2param3nodriverfoundforprinterxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param1param2noportfoundforprinterxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param1param2filescopiedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param1param2cantpublishpropertyxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param1param2param3cantgetcontainerxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param1param2cantdeleteprintqueuexmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param1param2param3cantcreateprintqueuexmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param1param2cantpublishmandatorypropertiesxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param1param2param3cantgetprimarydomaininfoxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1cantgetdnsdomainnamexmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1cantcrackxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param1param2printerpublishedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param1param2printernotpublishedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param1param2param3printerunpublishedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param1param2printernotunpublishedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param1param2param3printerupdatedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param1param2cantcrackguidxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param1param2missingprinterunpublishedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1pruningnouncprinterxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1pruningabsentprinterxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param1param2pruningunpublishedprinterxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1pruningduplicateprinterxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1pruningprinterxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1cantpruneprinterxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param1param2badoemdriverxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1backupspoolerregistryxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1badjobxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param1param2kmprinterblockedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1documentprioritychangedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param4param5param1param2param3param4param5eventdatainitfailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param1param2param3cantaddupdateclusterdriverxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param1param2param3offlineprinteraddfailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param1param2updatecolorprofilefailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param1param2portinitializationerrorxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param1param2printonprocfailededxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param4param5param6param7param8param9param10param11param1param2param3param4param5param6param7param8param9param10param11eventdatamachineinitfailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1spoolercreationfailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1printprocnoenumdataxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param1param2printprocenumdatafailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param1param2param3badserversecdestxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1noprintprocfoundforprinterxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param1param2verifypackageinformationfordriverfailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param1param2param3verifypackageinformationfailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param1param2packageregenerationfordriverfailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param1param2param3routererrorxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsnameerrornameerrorcsrimportfailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsdriversourcedrivererrordriversourcedrivererrorcsrregistryfailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsregistrykey1registrykey2registrykey1registrykey2csrregistryconnectionfailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsregistrykeyregistrykeycsrinvaliddrivertypexmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsnamenamespoolerpipelineerrorxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventshresulthresultjobdiagxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsjobidjobiddeletejobdiagxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsjobidjobsizedatatypepagespagespersidefilesopenedjobsizehighjobidjobsizedatatypepagespagespersidefilesopenedjobsizehighrenderjobdiagxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsjobidgdijobsizeicmmethodcolorxresyresqualitycopiesttoptionjobidgdijobsizeicmmethodcolorxresyresqualitycopiesttoptionloadpluginfailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsplugindllnameerrorcodecontextplugindllnameerrorcodecontextdeletedirfailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsdirectorynamewaitforrebooterrorcodecontextdirectorynamewaitforrebooterrorcodecontextfileopfailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventssourcedestinationflagserrorcodecontextsourcedestinationflagserrorcodecontextaddprintprocfailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsprocessorenvironmentpatherrorcodeprocessorenvironmentpatherrorcodereqrpcproseqfailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsprotocolsequenceendpointerrorcodecontextprotocolsequenceendpointerrorcodecontextinvalidrpcproseqxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsvalidatedprotocolsequenceexpectedprotocolsequenceerrorcodevalidatedprotocolsequenceexpectedprotocolsequenceerrorcoderpcendpointpoldisabledxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventswindowsstartereditionsuitestorageserversystemprintingdisabledsuitebladesuiteembeddedrestrictedsuitecomputerserverwindowsstartereditionsuitestorageserversystemprintingdisabledsuitebladesuiteembeddedrestrictedsuitecomputerserverstartrpcserverfailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventserrorcodecontexterrorcodecontextcsrdisabledbypolicyxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventspolicypolicycsrfailedreverttossrxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsprintprocessorconnectionisxpsprintererrorcodeprintprocessorconnectionisxpsprintererrorcodeforcecsrpolicysetxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsprinternameprinterpathportnameprinternameprinterpathportnamecsrstartingssrjobxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsjobidlevelstatusjobidlevelstatuscsrnoprintprocordatatypexmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventslocalprintprocessorremoteprintprocessordefaultprintprocessorlocaldatatyperemotedatatypedefaultdatatypeerrorcodelocalprintprocessorremoteprintprocessordefaultprintprocessorlocaldatatyperemotedatatypedefaultdatatypeerrorcodechangingdefaultprinterxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsdefaultprinterselectedbyspoolerolddefaultprinternewdefaultprinterstatusmoduledefaultprinterselectedbyspoolerolddefaultprinternewdefaultprinterstatusmoduleprintfilterpipelineshutdownxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsdocumentnamejobidprintqueueerrorinfodocumentnamejobidprintqueueerrorinfoprintdriversandboxjobprintprocxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsjobidprocessorprinterdriverisolationmodeerrorcodejobidprocessorprinterdriverisolationmodeerrorprintdriversandboxrpcsuccessratexmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventssucceededrpccallsfailedrpccallssucceededrpccallsfailedrpccallsprintdriversandboxmodeselectionxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsisolationmodeprinterdriverisolationmodeprinterdriverprintdriversandboxloadmodulexmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsmoduleprinterdrivererrorcodemoduleprinterdrivererrorxpsprintapiinvalidqueuexmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsqueuenamequeuenamexpsprintapijobfailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsjobiderrorcodejobiderrorcodeprintperfxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsnamecontextstatuscodenamecontextstatuscodeprinterscavengedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsprinternameprinterageexpiryageprinternameprinterageexpiryageprinterscheduledforscavengingxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsprinternameprinternameprintersharingxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsprinternamesharenameprinternamesharenameprinterdriverxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsdriverfunctiondriverfunctionpointandprintdisabledbypolicyxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsprintqueueerrorprintqueueerrorprintdrivermismatchxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsoriginaldrivernewdriverprinternameoriginaldrivernewdriverprinternameclientsiderenderingcachesyncxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventserrorcodeprinternameerrorprinternameopenprinterxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsprinternameaccesscodeprinternameaccesscodeconnectionxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsconnectionnameconnectionnameconnectionerrorxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsconnectionnameerrorcodeconnectionnameerrorforceddriverisolationdisabledxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsfailuresjobsprinternamedrivernamefailuresjobsprinternamedrivernameprintqueuedevnodecreatefailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsprinternamedeviceobjectinstanceidentifierhresulterrorcodeprinternamedeviceobjectinstanceidentifierhresulterrorcodewsdmoninitfailurexmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventshresulterrorcodehresulterrorcodecsruntrusteddriverxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsdrivererrordrivererrorspoolergenericeventxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventslabelerrorcodeobjectnamelabelerrorcodeobjectnameinvalidprinterdriverpairxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsprinternamedrivernameprinternamedrivernamebopofflinelogarchivefullxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsmachinenamemachinenamemicrosoft-windows-printservicewin:infowin:startwin:stopspooler_opcode_pendingspooler_opcode_succeededspooler_opcode_failedspooler_opcode_warningspooler_opcode_tracespooler_opcode_unexpected_shutdownxps_print_api_opcode_failedwin:criticalwin:errorwin:warningwin:informationalwin:verbosespooler_task_initializeprintprovidorspooler_task_openprinterspooler_task_closeprinterspooler_task_addprinterspooler_task_deleteprinterspooler_task_addconnectionspooler_task_deleteconnectionspooler_task_adddriverspooler_task_deletedriverspooler_task_startdocprinterspooler_task_enddocprinterspooler_task_startpagespooler_task_endpagespooler_task_seekprinterspooler_task_setprinterspooler_task_parseinfspooler_task_install_printer_driverspooler_task_copy_printer_driver_packagespooler_task_enumprintersspooler_task_tracespooler_task_pause_printerspooler_task_unpause_printerspooler_task_purge_printerspooler_task_print_documentspooler_task_delete_documentspooler_task_add_formspooler_task_delete_formspooler_task_share_printerspooler_task_unshare_printerspooler_task_initializespooler_task_publish_printerspooler_task_unpublish_printerspooler_task_prune_printerspooler_task_initialize_objectspooler_task_initialize_print_processorspooler_task_verify_regenerate_driver_packagespooler_task_route_commandsspooler_task_csrspooler_task_pipelinespooler_task_job_diagnosticsspooler_task_unexpected_shutdownspooler_task_delete_dirspooler_task_file_opspooler_task_enable_rpc_endpointsspooler_task_csr_reverting_to_ssrspooler_task_changing_default_printerspooler_task_print_driver_sandboxxps_print_api_taskxps_print_api_task_performancespooler_task_performancespooler_task_driver_monitoringspooler_task_connection_reconfiguredspooler_task_setup_wfsspooler_task_create_print_devnodespooler_task_wsdmon_initializationspooler_task_bop_offline_log_archive_fullspooler_keyword_localsplspooler_keyword_win32splspooler_keyword_printerspooler_keyword_jobspooler_keyword_connectionspooler_keyword_driverspooler_keyword_setupspooler_keyword_tracespooler_keyword_classicspooler_keyword_active_dirspooler_keyword_routerspooler_keyword_csrspooler_keyword_pipelinespooler_keywordspooler_keyword_print_driver_sandboxxps_print_api_keywordxps_print_api_keyword_performancespooler_keyword_branch_office_printingsetup_wfs_keywordspooler_keyword_wsdmonwin:responsetimewin:wdidiagwevt_templateen-uspbxv-pv@bes" - Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007376.00000000.113264.74491000.00000020.mdmp") Found URL "http://www.w3.org/xml/1998/namespaceindexed\settings\xpathopenmetadatakeyinxmlattributeopenmetadatavalueoverridetextcontentadditionalcontentbinarycontenttargetnamespace=" - Source: "00000000-00007376.00000000.113264.74D81000.00000020.mdmp") Found URL "http://software\microsoft\windows\currentversion\url\defaultprefix%hs(%d)\%hs!%p:" - Source: "00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=228610" - Source: "00000000-00007376.00000000.113264.77D79000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851152" - Source: "00000000-00007376.00000000.113264.77D79000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=852747the" - Source: "00000000-00007376.00000000.113264.77D79000.00000002.mdmp")ae:T5648,Found URL "http://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsoperationcodeerroroperationcodeerrorspoolerprintereventxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventslabelerrorcodeprinternamestatuslabelerrorcodeprinternamestatusspoolerjobeventxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventslabelerrorcodejobidprinternamestatuslabelerrorcodejobidprinternamestatusspoolergenericeventxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventslabelerrorcodeobjectnamelabelerrorcodeobjectnamesetupparseinfxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventslabelmessageadditionalinfoinfpathdrivernameinstallsectionprocessorarchitecturelasterrorhresultlabelmessageadditionalinfoinfpathdrivernameinstallsectionprocessorarchitecturelasterrorhresultsetupinstallprinterdriverxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventslabelmessageadditionalinfoinfpathdrivernameinstallsectionprocessorarchitecturepackageawarecoredriverdependencieslasterrorhresultlabelmessageadditionalinfoinfpathdrivernameinstallsectionprocessorarchitecturepackageawarecoredriverdependencieslasterrorhresultsetupcopyprinterdriverpackagexmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventslabelmessageadditionalinfoserverinfpathdestinfpathprocessorarchitecturelasterrorhresultlabelmessageadditionalinfoserverinfpathdestinfpathprocessorarchitecturelasterrorhresultsetupprinteroperationxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventscontextmessageadditionalinfoprocessorarchitecturelasterrorhresultcontextmessageadditionalinfoprocessorarchitecturelasterrorhresultsetupv4xmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsdrivernameinfpathrequiredclassdriverhresultdrivernameinfpathrequiredclassdriverhresultsetupunsupportedversionxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsdrivernameinfpathdrivermodelversiondrivernameinfpathdrivermodelversionsetupdirectivevaluexmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsdrivernameinfpathrequiredclassdriverdirectivevaluedrivernameinfpathrequiredclassdriverdirectivevaluesetupforbiddendirectivexmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsdrivernameinfpathrequiredclassdriverdirectiveclassdriveronlynonclassdriveronlydrivernameinfpathrequiredclassdriverdirectiveclassdriveronlynonclassdriveronlysetupmalformeddirectivexmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsdrivernameinfpathrequiredclassdriverdirectiveemptytokenincorrectnumberoftokensdrivernameinfpathrequiredclassdriverdirectiveemptytokenincorrectnumberoftokenssetupinvalidmanifestcountxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsdrivernameinfpathmissingmanifestmultiplemanifestsdrivernameinfpathmissingmanifestmultiplemanifestssetupwfsxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventshresulthresultspoolertracexmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsmessagelasterrormessagelasterrorremotepackagexmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsfunctionerrorserverfunctionerrorserverprintercreatedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1printerdeletedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1printerdeletionpendingxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1printerpausedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1printerunpausedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1printerpurgedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1printersetxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1documentprintedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param4param5param6param7param8param1param2param3param4param5param6param7param8documentpausedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param4param1param2param3param4documentresumedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param4param1param2param3param4documentdeletedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param4param1param2param3param4documentpositionchangedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param4param5param1param2param3param4param5formaddedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1formdeletedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1documenttimeoutxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param4param5param1param2param3param4param5sharefailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param1param2param3unsharefailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param1param2param3driveraddedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param4param1param2param3param4driverdeletedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1driverfailedupgradexmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param1param2param3nodriverfoundforprinterxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param1param2noportfoundforprinterxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param1param2filescopiedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param1param2cantpublishpropertyxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param1param2param3cantgetcontainerxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param1param2cantdeleteprintqueuexmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param1param2param3cantcreateprintqueuexmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param1param2cantpublishmandatorypropertiesxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param1param2param3cantgetprimarydomaininfoxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1cantgetdnsdomainnamexmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1cantcrackxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param1param2printerpublishedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param1param2printernotpublishedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param1param2param3printerunpublishedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param1param2printernotunpublishedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param1param2param3printerupdatedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param1param2cantcrackguidxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param1param2missingprinterunpublishedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1pruningnouncprinterxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1pruningabsentprinterxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param1param2pruningunpublishedprinterxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1pruningduplicateprinterxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1pruningprinterxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1cantpruneprinterxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param1param2badoemdriverxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1backupspoolerregistryxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1badjobxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param1param2kmprinterblockedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1documentprioritychangedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param4param5param1param2param3param4param5eventdatainitfailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param1param2param3cantaddupdateclusterdriverxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param1param2param3offlineprinteraddfailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param1param2updatecolorprofilefailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param1param2portinitializationerrorxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param1param2printonprocfailededxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param4param5param6param7param8param9param10param11param1param2param3param4param5param6param7param8param9param10param11eventdatamachineinitfailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1spoolercreationfailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1printprocnoenumdataxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param1param2printprocenumdatafailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param1param2param3badserversecdestxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1noprintprocfoundforprinterxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param1param2verifypackageinformationfordriverfailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param1param2param3verifypackageinformationfailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param1param2packageregenerationfordriverfailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param1param2param3routererrorxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsnameerrornameerrorcsrimportfailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsdriversourcedrivererrordriversourcedrivererrorcsrregistryfailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsregistrykey1registrykey2registrykey1registrykey2csrregistryconnectionfailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsregistrykeyregistrykeycsrinvaliddrivertypexmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsnamenamespoolerpipelineerrorxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventshresulthresultjobdiagxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsjobidjobiddeletejobdiagxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsjobidjobsizedatatypepagespagespersidefilesopenedjobsizehighjobidjobsizedatatypepagespagespersidefilesopenedjobsizehighrenderjobdiagxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsjobidgdijobsizeicmmethodcolorxresyresqualitycopiesttoptionjobidgdijobsizeicmmethodcolorxresyresqualitycopiesttoptionloadpluginfailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsplugindllnameerrorcodecontextplugindllnameerrorcodecontextdeletedirfailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsdirectorynamewaitforrebooterrorcodecontextdirectorynamewaitforrebooterrorcodecontextfileopfailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventssourcedestinationflagserrorcodecontextsourcedestinationflagserrorcodecontextaddprintprocfailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsprocessorenvironmentpatherrorcodeprocessorenvironmentpatherrorcodereqrpcproseqfailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsprotocolsequenceendpointerrorcodecontextprotocolsequenceendpointerrorcodecontextinvalidrpcproseqxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsvalidatedprotocolsequenceexpectedprotocolsequenceerrorcodevalidatedprotocolsequenceexpectedprotocolsequenceerrorcoderpcendpointpoldisabledxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventswindowsstartereditionsuitestorageserversystemprintingdisabledsuitebladesuiteembeddedrestrictedsuitecomputerserverwindowsstartereditionsuitestorageserversystemprintingdisabledsuitebladesuiteembeddedrestrictedsuitecomputerserverstartrpcserverfailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventserrorcodecontexterrorcodecontextcsrdisabledbypolicyxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventspolicypolicycsrfailedreverttossrxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsprintprocessorconnectionisxpsprintererrorcodeprintprocessorconnectionisxpsprintererrorcodeforcecsrpolicysetxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsprinternameprinterpathportnameprinternameprinterpathportnamecsrstartingssrjobxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsjobidlevelstatusjobidlevelstatuscsrnoprintprocordatatypexmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventslocalprintprocessorremoteprintprocessordefaultprintprocessorlocaldatatyperemotedatatypedefaultdatatypeerrorcodelocalprintprocessorremoteprintprocessordefaultprintprocessorlocaldatatyperemotedatatypedefaultdatatypeerrorcodechangingdefaultprinterxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsdefaultprinterselectedbyspoolerolddefaultprinternewdefaultprinterstatusmoduledefaultprinterselectedbyspoolerolddefaultprinternewdefaultprinterstatusmoduleprintfilterpipelineshutdownxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsdocumentnamejobidprintqueueerrorinfodocumentnamejobidprintqueueerrorinfoprintdriversandboxjobprintprocxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsjobidprocessorprinterdriverisolationmodeerrorcodejobidprocessorprinterdriverisolationmodeerrorprintdriversandboxrpcsuccessratexmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventssucceededrpccallsfailedrpccallssucceededrpccallsfailedrpccallsprintdriversandboxmodeselectionxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsisolationmodeprinterdriverisolationmodeprinterdriverprintdriversandboxloadmodulexmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsmoduleprinterdrivererrorcodemoduleprinterdrivererrorxpsprintapiinvalidqueuexmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsqueuenamequeuenamexpsprintapijobfailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsjobiderrorcodejobiderrorcodeprintperfxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsnamecontextstatuscodenamecontextstatuscodeprinterscavengedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsprinternameprinterageexpiryageprinternameprinterageexpiryageprinterscheduledforscavengingxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsprinternameprinternameprintersharingxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsprinternamesharenameprinternamesharenameprinterdriverxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsdriverfunctiondriverfunctionpointandprintdisabledbypolicyxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsprintqueueerrorprintqueueerrorprintdrivermismatchxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsoriginaldrivernewdriverprinternameoriginaldrivernewdriverprinternameclientsiderenderingcachesyncxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventserrorcodeprinternameerrorprinternameopenprinterxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsprinternameaccesscodeprinternameaccesscodeconnectionxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsconnectionnameconnectionnameconnectionerrorxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsconnectionnameerrorcodeconnectionnameerrorforceddriverisolationdisabledxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsfailuresjobsprinternamedrivernamefailuresjobsprinternamedrivernameprintqueuedevnodecreatefailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsprinternamedeviceobjectinstanceidentifierhresulterrorcodeprinternamedeviceobjectinstanceidentifierhresulterrorcodewsdmoninitfailurexmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventshresulterrorcodehresulterrorcodecsruntrusteddriverxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsdrivererrordrivererrorspoolergenericeventxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventslabelerrorcodeobjectnamelabelerrorcodeobjectnameinvalidprinterdriverpairxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsprinternamedrivernameprinternamedrivernamebopofflinelogarchivefullxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsmachinenamemachinenamemicrosoft-windows-printservicewin:infowin:startwin:stopspooler_opcode_pendingspooler_opcode_succeededspooler_opcode_failedspooler_opcode_warningspooler_opcode_tracespooler_opcode_unexpected_shutdownxps_print_api_opcode_failedwin:criticalwin:errorwin:warningwin:informationalwin:verbosespooler_task_initializeprintprovidorspooler_task_openprinterspooler_task_closeprinterspooler_task_addprinterspooler_task_deleteprinterspooler_task_addconnectionspooler_task_deleteconnectionspooler_task_adddriverspooler_task_deletedriverspooler_task_startdocprinterspooler_task_enddocprinterspooler_task_startpagespooler_task_endpagespooler_task_seekprinterspooler_task_setprinterspooler_task_parseinfspooler_task_install_printer_driverspooler_task_copy_printer_driver_packagespooler_task_enumprintersspooler_task_tracespooler_task_pause_printerspooler_task_unpause_printerspooler_task_purge_printerspooler_task_print_documentspooler_task_delete_documentspooler_task_add_formspooler_task_delete_formspooler_task_share_printerspooler_task_unshare_printerspooler_task_initializespooler_task_publish_printerspooler_task_unpublish_printerspooler_task_prune_printerspooler_task_initialize_objectspooler_task_initialize_print_processorspooler_task_verify_regenerate_driver_packagespooler_task_route_commandsspooler_task_csrspooler_task_pipelinespooler_task_job_diagnosticsspooler_task_unexpected_shutdownspooler_task_delete_dirspooler_task_file_opspooler_task_enable_rpc_endpointsspooler_task_csr_reverting_to_ssrspooler_task_changing_default_printerspooler_task_print_driver_sandboxxps_print_api_taskxps_print_api_task_performancespooler_task_performancespooler_task_driver_monitoringspooler_task_connection_reconfiguredspooler_task_setup_wfsspooler_task_create_print_devnodespooler_task_wsdmon_initializationspooler_task_bop_offline_log_archive_fullspooler_keyword_localsplspooler_keyword_win32splspooler_keyword_printerspooler_keyword_jobspooler_keyword_connectionspooler_keyword_driverspooler_keyword_setupspooler_keyword_tracespooler_keyword_classicspooler_keyword_active_dirspooler_keyword_routerspooler_keyword_csrspooler_keyword_pipelinespooler_keywordspooler_keyword_print_driver_sandboxxps_print_api_keywordxps_print_api_keyword_performancespooler_keyword_branch_office_printingsetup_wfs_keywordspooler_keyword_wsdmonwin:responsetimewin:wdidiagwevt_templateen-uspbxv-pv@bes" - Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp")af:T5648,Found URL "http://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsoperationcodeerroroperationcodeerrorspoolerprintereventxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventslabelerrorcodeprinternamestatuslabelerrorcodeprinternamestatusspoolerjobeventxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventslabelerrorcodejobidprinternamestatuslabelerrorcodejobidprinternamestatusspoolergenericeventxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventslabelerrorcodeobjectnamelabelerrorcodeobjectnamesetupparseinfxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventslabelmessageadditionalinfoinfpathdrivernameinstallsectionprocessorarchitecturelasterrorhresultlabelmessageadditionalinfoinfpathdrivernameinstallsectionprocessorarchitecturelasterrorhresultsetupinstallprinterdriverxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventslabelmessageadditionalinfoinfpathdrivernameinstallsectionprocessorarchitecturepackageawarecoredriverdependencieslasterrorhresultlabelmessageadditionalinfoinfpathdrivernameinstallsectionprocessorarchitecturepackageawarecoredriverdependencieslasterrorhresultsetupcopyprinterdriverpackagexmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventslabelmessageadditionalinfoserverinfpathdestinfpathprocessorarchitecturelasterrorhresultlabelmessageadditionalinfoserverinfpathdestinfpathprocessorarchitecturelasterrorhresultsetupprinteroperationxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventscontextmessageadditionalinfoprocessorarchitecturelasterrorhresultcontextmessageadditionalinfoprocessorarchitecturelasterrorhresultsetupv4xmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsdrivernameinfpathrequiredclassdriverhresultdrivernameinfpathrequiredclassdriverhresultsetupunsupportedversionxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsdrivernameinfpathdrivermodelversiondrivernameinfpathdrivermodelversionsetupdirectivevaluexmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsdrivernameinfpathrequiredclassdriverdirectivevaluedrivernameinfpathrequiredclassdriverdirectivevaluesetupforbiddendirectivexmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsdrivernameinfpathrequiredclassdriverdirectiveclassdriveronlynonclassdriveronlydrivernameinfpathrequiredclassdriverdirectiveclassdriveronlynonclassdriveronlysetupmalformeddirectivexmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsdrivernameinfpathrequiredclassdriverdirectiveemptytokenincorrectnumberoftokensdrivernameinfpathrequiredclassdriverdirectiveemptytokenincorrectnumberoftokenssetupinvalidmanifestcountxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsdrivernameinfpathmissingmanifestmultiplemanifestsdrivernameinfpathmissingmanifestmultiplemanifestssetupwfsxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventshresulthresultspoolertracexmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsmessagelasterrormessagelasterrorremotepackagexmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsfunctionerrorserverfunctionerrorserverprintercreatedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1printerdeletedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1printerdeletionpendingxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1printerpausedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1printerunpausedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1printerpurgedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1printersetxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1documentprintedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param4param5param6param7param8param1param2param3param4param5param6param7param8documentpausedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param4param1param2param3param4documentresumedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param4param1param2param3param4documentdeletedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param4param1param2param3param4documentpositionchangedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param4param5param1param2param3param4param5formaddedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1formdeletedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1documenttimeoutxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param4param5param1param2param3param4param5sharefailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param1param2param3unsharefailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param1param2param3driveraddedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param4param1param2param3param4driverdeletedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1driverfailedupgradexmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param1param2param3nodriverfoundforprinterxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param1param2noportfoundforprinterxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param1param2filescopiedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param1param2cantpublishpropertyxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param1param2param3cantgetcontainerxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param1param2cantdeleteprintqueuexmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param1param2param3cantcreateprintqueuexmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param1param2cantpublishmandatorypropertiesxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param1param2param3cantgetprimarydomaininfoxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1cantgetdnsdomainnamexmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1cantcrackxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param1param2printerpublishedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param1param2printernotpublishedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param1param2param3printerunpublishedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param1param2printernotunpublishedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param1param2param3printerupdatedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param1param2cantcrackguidxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param1param2missingprinterunpublishedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1pruningnouncprinterxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1pruningabsentprinterxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param1param2pruningunpublishedprinterxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1pruningduplicateprinterxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1pruningprinterxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1cantpruneprinterxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param1param2badoemdriverxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1backupspoolerregistryxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1badjobxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param1param2kmprinterblockedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1documentprioritychangedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param4param5param1param2param3param4param5eventdatainitfailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param1param2param3cantaddupdateclusterdriverxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param1param2param3offlineprinteraddfailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param1param2updatecolorprofilefailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param1param2portinitializationerrorxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param1param2printonprocfailededxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param4param5param6param7param8param9param10param11param1param2param3param4param5param6param7param8param9param10param11eventdatamachineinitfailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1spoolercreationfailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1printprocnoenumdataxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param1param2printprocenumdatafailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param1param2param3badserversecdestxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param1noprintprocfoundforprinterxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param1param2verifypackageinformationfordriverfailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param1param2param3verifypackageinformationfailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param1param2packageregenerationfordriverfailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsparam1param2param3param1param2param3routererrorxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsnameerrornameerrorcsrimportfailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsdriversourcedrivererrordriversourcedrivererrorcsrregistryfailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsregistrykey1registrykey2registrykey1registrykey2csrregistryconnectionfailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsregistrykeyregistrykeycsrinvaliddrivertypexmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsnamenamespoolerpipelineerrorxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventshresulthresultjobdiagxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsjobidjobiddeletejobdiagxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsjobidjobsizedatatypepagespagespersidefilesopenedjobsizehighjobidjobsizedatatypepagespagespersidefilesopenedjobsizehighrenderjobdiagxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsjobidgdijobsizeicmmethodcolorxresyresqualitycopiesttoptionjobidgdijobsizeicmmethodcolorxresyresqualitycopiesttoptionloadpluginfailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsplugindllnameerrorcodecontextplugindllnameerrorcodecontextdeletedirfailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsdirectorynamewaitforrebooterrorcodecontextdirectorynamewaitforrebooterrorcodecontextfileopfailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventssourcedestinationflagserrorcodecontextsourcedestinationflagserrorcodecontextaddprintprocfailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsprocessorenvironmentpatherrorcodeprocessorenvironmentpatherrorcodereqrpcproseqfailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsprotocolsequenceendpointerrorcodecontextprotocolsequenceendpointerrorcodecontextinvalidrpcproseqxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsvalidatedprotocolsequenceexpectedprotocolsequenceerrorcodevalidatedprotocolsequenceexpectedprotocolsequenceerrorcoderpcendpointpoldisabledxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventswindowsstartereditionsuitestorageserversystemprintingdisabledsuitebladesuiteembeddedrestrictedsuitecomputerserverwindowsstartereditionsuitestorageserversystemprintingdisabledsuitebladesuiteembeddedrestrictedsuitecomputerserverstartrpcserverfailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventserrorcodecontexterrorcodecontextcsrdisabledbypolicyxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventspolicypolicycsrfailedreverttossrxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsprintprocessorconnectionisxpsprintererrorcodeprintprocessorconnectionisxpsprintererrorcodeforcecsrpolicysetxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsprinternameprinterpathportnameprinternameprinterpathportnamecsrstartingssrjobxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsjobidlevelstatusjobidlevelstatuscsrnoprintprocordatatypexmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventslocalprintprocessorremoteprintprocessordefaultprintprocessorlocaldatatyperemotedatatypedefaultdatatypeerrorcodelocalprintprocessorremoteprintprocessordefaultprintprocessorlocaldatatyperemotedatatypedefaultdatatypeerrorcodechangingdefaultprinterxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsdefaultprinterselectedbyspoolerolddefaultprinternewdefaultprinterstatusmoduledefaultprinterselectedbyspoolerolddefaultprinternewdefaultprinterstatusmoduleprintfilterpipelineshutdownxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsdocumentnamejobidprintqueueerrorinfodocumentnamejobidprintqueueerrorinfoprintdriversandboxjobprintprocxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsjobidprocessorprinterdriverisolationmodeerrorcodejobidprocessorprinterdriverisolationmodeerrorprintdriversandboxrpcsuccessratexmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventssucceededrpccallsfailedrpccallssucceededrpccallsfailedrpccallsprintdriversandboxmodeselectionxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsisolationmodeprinterdriverisolationmodeprinterdriverprintdriversandboxloadmodulexmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsmoduleprinterdrivererrorcodemoduleprinterdrivererrorxpsprintapiinvalidqueuexmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsqueuenamequeuenamexpsprintapijobfailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsjobiderrorcodejobiderrorcodeprintperfxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsnamecontextstatuscodenamecontextstatuscodeprinterscavengedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsprinternameprinterageexpiryageprinternameprinterageexpiryageprinterscheduledforscavengingxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsprinternameprinternameprintersharingxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsprinternamesharenameprinternamesharenameprinterdriverxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsdriverfunctiondriverfunctionpointandprintdisabledbypolicyxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsprintqueueerrorprintqueueerrorprintdrivermismatchxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsoriginaldrivernewdriverprinternameoriginaldrivernewdriverprinternameclientsiderenderingcachesyncxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventserrorcodeprinternameerrorprinternameopenprinterxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsprinternameaccesscodeprinternameaccesscodeconnectionxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsconnectionnameconnectionnameconnectionerrorxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsconnectionnameerrorcodeconnectionnameerrorforceddriverisolationdisabledxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsfailuresjobsprinternamedrivernamefailuresjobsprinternamedrivernameprintqueuedevnodecreatefailedxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsprinternamedeviceobjectinstanceidentifierhresulterrorcodeprinternamedeviceobjectinstanceidentifierhresulterrorcodewsdmoninitfailurexmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventshresulterrorcodehresulterrorcodecsruntrusteddriverxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsdrivererrordrivererrorspoolergenericeventxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventslabelerrorcodeobjectnamelabelerrorcodeobjectnameinvalidprinterdriverpairxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsprinternamedrivernameprinternamedrivernamebopofflinelogarchivefullxmlnshttp://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/eventsmachinenamemachinenamemicrosoft-windows-printservicewin:infowin:startwin:stopspooler_opcode_pendingspooler_opcode_succeededspooler_opcode_failedspooler_opcode_warningspooler_opcode_tracespooler_opcode_unexpected_shutdownxps_print_api_opcode_failedwin:criticalwin:errorwin:warningwin:informationalwin:verbosespooler_task_initializeprintprovidorspooler_task_openprinterspooler_task_closeprinterspooler_task_addprinterspooler_task_deleteprinterspooler_task_addconnectionspooler_task_deleteconnectionspooler_task_adddriverspooler_task_deletedriverspooler_task_startdocprinterspooler_task_enddocprinterspooler_task_startpagespooler_task_endpagespooler_task_seekprinterspooler_task_setprinterspooler_task_parseinfspooler_task_install_printer_driverspooler_task_copy_printer_driver_packagespooler_task_enumprintersspooler_task_tracespooler_task_pause_printerspooler_task_unpause_printerspooler_task_purge_printerspooler_task_print_documentspooler_task_delete_documentspooler_task_add_formspooler_task_delete_formspooler_task_share_printerspooler_task_unshare_printerspooler_task_initializespooler_task_publish_printerspooler_task_unpublish_printerspooler_task_prune_printerspooler_task_initialize_objectspooler_task_initialize_print_processorspooler_task_verify_regenerate_driver_packagespooler_task_route_commandsspooler_task_csrspooler_task_pipelinespooler_task_job_diagnosticsspooler_task_unexpected_shutdownspooler_task_delete_dirspooler_task_file_opspooler_task_enable_rpc_endpointsspooler_task_csr_reverting_to_ssrspooler_task_changing_default_printerspooler_task_print_driver_sandboxxps_print_api_taskxps_print_api_task_performancespooler_task_performancespooler_task_driver_monitoringspooler_task_connection_reconfiguredspooler_task_setup_wfsspooler_task_create_print_devnodespooler_task_wsdmon_initializationspooler_task_bop_offline_log_archive_fullspooler_keyword_localsplspooler_keyword_win32splspooler_keyword_printerspooler_keyword_jobspooler_keyword_connectionspooler_keyword_driverspooler_keyword_setupspooler_keyword_tracespooler_keyword_classicspooler_keyword_active_dirspooler_keyword_routerspooler_keyword_csrspooler_keyword_pipelinespooler_keywordspooler_keyword_print_driver_sandboxxps_print_api_keywordxps_print_api_keyword_performancespooler_keyword_branch_office_printingsetup_wfs_keywordspooler_keyword_wsdmonwin:responsetimewin:wdidiagwevt_templateen-uspbxv-pv@bes" - Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp")b0:T4f2,Found reference to API "Wow64DisableWow64FsRedirection" (Indicator: "Wow64DisableWow64FsRedirection"; Source: "00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "Wow64RevertWow64FsRedirection" (Indicator: "Wow64RevertWow64FsRedirection"; Source: "00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")b1:Te22,Found reference to API "RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp") Found reference to API "hook_RtlGetNtProductType" (Indicator: "RtlGetNtProductType"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "hook_RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "RtlGetNtProductType" (Indicator: "RtlGetNtProductType"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp") Found reference to API "Exception in hook_RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "NS_VistaRTMVersionLie::APIHook_RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_VistaSP1VersionLie::APIHook_RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_VistaSP2VersionLie::APIHook_RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_Win2k3RTMVersionLie::APIHook_RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_Win2k3SP1VersionLie::APIHook_RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_Win7RTMVersionLie::APIHook_RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_Win8RTMVersionLie::APIHook_RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_Win81RTMVersionLie::APIHook_RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_WinXPSP1VersionLie::APIHook_RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_WinXPSP2VersionLie::APIHook_RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_WinXPSP3VersionLie::APIHook_RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_WinXPVersionLie::APIHook_RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp")b2:T4023,Found registry query API: "" in "00000000-00007376.00000000.113264.00680000.00000004.mdmp" Found registry query API: "" in "00000000-00007376.00000000.113264.00680000.00000004.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74893000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74893000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp" Found registry query API: "RegGetValueW" in "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp" Found registry query API: "RegEnumKeyExA" in "00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp" Found registry query API: "RegQueryInfoKeyA" in "00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp" Found registry query API: "RegOpenCurrentUser" in "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp" Found registry query API: "ProfilesRegQueryValueEx" in "00000000-00007376.00000000.113264.730C1000.00000020.mdmp" Found registry query API: "RegOpenKeyExA: wrp key is mitigated" in "00000000-00007376.00000000.113264.730C1000.00000020.mdmp" Found registry query API: "RegOpenKeyA" in "00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp" Found registry query API: "RegOpenKeyW" in "00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.777D1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp" Found registry query API: "RegOpenUserClassesRoot" in "00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp" Found registry query API: "RegQueryValueA" in "00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp" Found registry query API: "RegQueryValueW" in "00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.74D81000.00000020.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.777D1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp" Found registry query API: "RegEnumValueA" in "00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp" Found registry query API: "RegEnumValueW" in "00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp" Found registry query API: "RegEnumKeyA" in "00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp" Found registry query API: "RegEnumKeyW" in "00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.74D81000.00000020.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74893000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74893000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp" Found registry query API: "RegGetValueA" in "00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp" Found registry query API: "Unexpected error returned from RegEnumValueW %d" in "00000000-00007376.00000000.113264.730C1000.00000020.mdmp"b3:T6c2,Found registry query API: "RegQueryValueExW" in "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74893000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"b4:T76d,Found registry query API: "RegOpenKeyExW" in "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74893000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"b5:T4b4,Found registry query API: "RegGetValueW" in "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"b6:T441,Found registry query API: "RegOpenKeyExA" in "00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"b7:T4ef,Found registry query API: "RegEnumKeyExW" in "00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74893000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"b8:T47e,Found registry query API: "RegQueryInfoKeyW" in "00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74893000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"b9:T6c2,Found registry query API: "RegQueryValueExW" in "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74893000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"ba:T76d,Found registry query API: "RegOpenKeyExW" in "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74893000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"bb:T4b4,Found registry query API: "RegGetValueW" in "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"bc:T441,Found registry query API: "RegOpenKeyExA" in "00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"bd:T4ef,Found registry query API: "RegEnumKeyExW" in "00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74893000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"be:T47e,Found registry query API: "RegQueryInfoKeyW" in "00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74893000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"bf:T90e,Found string "Guyanaese Dollar" (Indicator: "aes"; Source: "00000000-00007376.00000000.113264.00320000.00000002.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.74841000.00000020.mdmp") Found string "ECDSA_P256" (Indicator: "ecdsa"; Source: "00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.74841000.00000020.mdmp") Found string "ECDSA_P384" (Indicator: "ecdsa"; Source: "00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.74841000.00000020.mdmp") Found string "ECDSA_P521" (Indicator: "ecdsa"; Source: "00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.74841000.00000020.mdmp") Found string "AES-GMAC" (Indicator: "aes"; Source: "00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.74841000.00000020.mdmp") Found string "3DES" (Indicator: "3des"; Source: "00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.74841000.00000020.mdmp") Found string "3DES_112" (Indicator: "3des"; Source: "00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.74841000.00000020.mdmp") Found string "AES-CMAC" (Indicator: "aes"; Source: "00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.74841000.00000020.mdmp") Found string "XTS-AES" (Indicator: "aes"; Source: "00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.74841000.00000020.mdmp") Found string "onecore\ds\security\cryptoapi\ncrypt\crypt\routeraeskeywrap.c" (Indicator: "aes"; Source: "00000000-00007376.00000000.113264.73451000.00000020.mdmp") Found string ">RSA2" (Indicator: "rsa2"; Source: "00000000-00007376.00000000.113264.73451000.00000020.mdmp") Found string "RSA2S" (Indicator: "rsa2"; Source: "00000000-00007376.00000000.113264.73451000.00000020.mdmp") Found string "RSA2" (Indicator: "rsa2"; Source: "00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.74841000.00000020.mdmp") Found string "RSA2P" (Indicator: "rsa2"; Source: "00000000-00007376.00000000.113264.73451000.00000020.mdmp")c0:T205f,Found reference to API "hook_CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.748A1000.00000020.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74E31000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.76E31000.00000020.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "CreateDCW" (Indicator: "CreateDC"; Source: "00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.748A1000.00000020.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74E31000.00000020.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76E31000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetDCEx" (Indicator: "GetDC"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "CreateDCA" (Indicator: "CreateDC"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.748A1000.00000020.mdmp, 00000000-00007376.00000000.113264.74E31000.00000020.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.748A1000.00000020.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74E31000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.76E31000.00000020.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.748A1000.00000020.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74E31000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.76E31000.00000020.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.748A1000.00000020.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74E31000.00000020.mdmp, 00000000-00007376.00000000.113264.76E31000.00000020.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetDCDpiScaleValue" (Indicator: "GetDC"; Source: "00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.748A1000.00000020.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74E31000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetDC: Wnd: %p, DC: %p" (Indicator: "GetDC"; Source: "00000000-00007376.00000000.113264.74491000.00000020.mdmp") Found reference to API "DWM8AND16BitHook_GetDC" (Indicator: "GetDC"; Source: "00000000-00007376.00000000.113264.74491000.00000020.mdmp") Found reference to API "DWM8AND16BitHook_GetDCEx" (Indicator: "GetDC"; Source: "00000000-00007376.00000000.113264.74491000.00000020.mdmp") Found reference to API "GetWindowDC: Wnd: %p, DC: %p" (Indicator: "GetWindowDC"; Source: "00000000-00007376.00000000.113264.74491000.00000020.mdmp") Found reference to API "DWM8AND16BitHook_GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00007376.00000000.113264.74491000.00000020.mdmp") Found reference to API "DWM8AND16BitCOMHook_IDirectDrawSurface_GetDC" (Indicator: "GetDC"; Source: "00000000-00007376.00000000.113264.74491000.00000020.mdmp") Found reference to API "DWM8AND16BitCOMHook_IDirectDrawSurface2_GetDC" (Indicator: "GetDC"; Source: "00000000-00007376.00000000.113264.74491000.00000020.mdmp") Found reference to API "DWM8AND16BitCOMHook_IDirectDrawSurface3_GetDC" (Indicator: "GetDC"; Source: "00000000-00007376.00000000.113264.74491000.00000020.mdmp") Found reference to API "DWM8AND16BitCOMHook_IDirectDrawSurface4_GetDC" (Indicator: "GetDC"; Source: "00000000-00007376.00000000.113264.74491000.00000020.mdmp") Found reference to API "DWM8AND16BitCOMHook_IDirectDrawSurface7_GetDC" (Indicator: "GetDC"; Source: "00000000-00007376.00000000.113264.74491000.00000020.mdmp") Found reference to API "Failed to BitBlt from src to dest DC." (Indicator: "BitBlt"; Source: "00000000-00007376.00000000.113264.74491000.00000020.mdmp") Found reference to API "DirectDrawSurface::GetDC" (Indicator: "GetDC"; Source: "00000000-00007376.00000000.113264.74491000.00000020.mdmp") Found reference to API "DirectDrawSurface::GetDC" (Indicator: "GetDC"; Source: "00000000-00007376.00000000.113264.74491000.00000020.mdmp")c1:T64f,Found reference to API "hook_GetDriveTypeA" (Indicator: "GetDriveType"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "hook_GetDriveTypeW" (Indicator: "GetDriveType"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "GetDriveType" (Indicator: "GetDriveType"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "GetDriveTypeA" (Indicator: "GetDriveType"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetDriveTypeW" (Indicator: "GetDriveType"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")c2:T12ca,Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "hook_FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "hook_FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "hook_FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "hook_FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "FindFirstFile failed for %ws [GLE: %x]" (Indicator: "FindFirstFile"; Source: "00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "FindFirstFile failed for %ws [GLE: %d]" (Indicator: "FindFirstFile"; Source: "00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "FindFirstFile Failed on [%ws] [%d]" (Indicator: "FindFirstFile"; Source: "00000000-00007376.00000000.113264.74491000.00000020.mdmp")c3:T426,Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")c4:T426,Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")c5:T3913,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.74736000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74768000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74893000.00000002.mdmp, 00000000-00007376.00000000.113264.748BB000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.74736000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74768000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.748BB000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "Thread32Next" (Indicator: "Thread32Next"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "Thread32First" (Indicator: "Thread32First"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74893000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "hook_CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "hook_Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "hook_Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "WTSEnumerateProcessesA" (Indicator: "WTSEnumerateProcesses"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "WTSEnumerateProcessesW" (Indicator: "WTSEnumerateProcesses"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "WTSEnumerateProcessesExA" (Indicator: "WTSEnumerateProcesses"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "WTSEnumerateProcessesExW" (Indicator: "WTSEnumerateProcesses"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.74654000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74893000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp") Found reference to API "NS_EmulateEnvironmentBlock::APIHook_GetEnvironmentStringsA" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_EmulateEnvironmentBlock::APIHook_GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetEnvironmentStringsA" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "NtQueryInformationProcess failed [%x]" (Indicator: "QueryInformationProcess"; Source: "00000000-00007376.00000000.113264.74491000.00000020.mdmp")c6:T8f1,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.74736000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74768000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74893000.00000002.mdmp, 00000000-00007376.00000000.113264.748BB000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")c7:T8b9,Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.74736000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74768000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.748BB000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")c8:T5fc,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")c9:T5fe,Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74893000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")ca:T477,Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.74654000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74893000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp")cb:T8f1,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.74736000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74768000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74893000.00000002.mdmp, 00000000-00007376.00000000.113264.748BB000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")cc:T8b9,Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.74736000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74768000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.748BB000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")cd:T5fc,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")ce:T5fe,Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74893000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")cf:T477,Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.74654000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74893000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp")d0:T5fc,Found reference to API "ReadFile" (Indicator: "ReadFile"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "NtReadFile" (Indicator: "NtReadFile"; Source: "00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp")d1:T1005,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74893000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "Armadillo_GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00007376.00000000.113264.74491000.00000020.mdmp") Found reference to API "GetModuleHandle(NULL) failed [%d]" (Indicator: "GetModuleHandle"; Source: "00000000-00007376.00000000.113264.74491000.00000020.mdmp")d2:T5fc,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")d3:T5fe,Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74893000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")d4:T5fc,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")d5:T5fe,Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74893000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")d6:Teb9,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74768000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "LdrGetProcedureAddress" (Indicator: "LdrGetProcedureAddress"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778E3000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp") Found reference to API "NS_ForceDXSetupSuccess::APIHook_GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_WRPDllRegister::APIHook_GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "SE_GetProcAddressForCaller" (Indicator: "GetProcAddress"; Source: "00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp") Found reference to API "SeHookManagerGetProcAddress failed" (Indicator: "GetProcAddress"; Source: "00000000-00007376.00000000.113264.74491000.00000020.mdmp") Found reference to API "SE_GetProcAddressIgnoreIncExc" (Indicator: "GetProcAddress"; Source: "00000000-00007376.00000000.113264.74491000.00000020.mdmp") Found reference to API "SE_GetProcAddressLoad" (Indicator: "GetProcAddress"; Source: "00000000-00007376.00000000.113264.74491000.00000020.mdmp") Found reference to API "SeHookManagerGetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00007376.00000000.113264.74491000.00000020.mdmp")d7:T803,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74768000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")d8:T803,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74768000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")d9:T2dd7,Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "NtQueryAttributesFile" (Indicator: "QueryAttributesFile"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp") Found reference to API "NtQueryInformationFile" (Indicator: "QueryInformationFile"; Source: "00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp") Found reference to API "ZwQueryInformationFile" (Indicator: "QueryInformationFile"; Source: "00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "NS_ProfilesGetFolderPath::APIHook_SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "NS_SyncSystem32AndSysWow64::APIHook_GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_SyncSystem32AndSysWow64::APIHook_GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_SyncSystem32AndSysWow64::APIHook_GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_SyncSystem32AndSysWow64::APIHook_GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "NS_SyncSystemAndSystem32::APIHook_GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_SyncSystemAndSystem32::APIHook_GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_SyncSystemAndSystem32::APIHook_GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_SyncSystemAndSystem32::APIHook_GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "BuildDXDiag: GetSystemDirectory Failed" (Indicator: "GetSystemDirectory"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "SpellIt: GetSystemDirectory Failed" (Indicator: "GetSystemDirectory"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "PathFindFileNameW" (Indicator: "PathFindFileName"; Source: "00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74D81000.00000020.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")da:T46c,Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")db:T46c,Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")dc:T8d4,Found reference to API "hook_GetComputerNameExA" (Indicator: "GetComputerName"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "hook_GetComputerNameExW" (Indicator: "GetComputerName"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "GetComputerNameA" (Indicator: "GetComputerName"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetComputerNameW" (Indicator: "GetComputerName"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetComputerNameExA" (Indicator: "GetComputerName"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetComputerNameExW" (Indicator: "GetComputerName"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")dd:Tb42,Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74893000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "Armadillo_GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00007376.00000000.113264.74491000.00000020.mdmp")de:T600,Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74893000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")df:T4a4,Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")e0:T600,Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74893000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")e1:T4a4,Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")e2:T64c,Found reference to API "GetEnvironmentVariableW" (Indicator: "GetEnvironmentVariable"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetEnvironmentVariableA" (Indicator: "GetEnvironmentVariable"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "NS_ProfilesEnvStrings::APIHook_GetEnvironmentVariableA" (Indicator: "GetEnvironmentVariable"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_ProfilesEnvStrings::APIHook_GetEnvironmentVariableW" (Indicator: "GetEnvironmentVariable"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp")e3:T46e,Found reference to API "hook_GetSystemMetrics" (Indicator: "GetSystemMetrics"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "GetSystemMetrics" (Indicator: "GetSystemMetrics"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76501000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetSystemMetricsForDpi" (Indicator: "GetSystemMetrics"; Source: "00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")e4:T970,Found reference to API "GetTickCount" (Indicator: "GetTickCount"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.74736000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74768000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.748BB000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")e5:T717,Found reference to API "GetTickCount" (Indicator: "GetTickCount"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.74736000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74768000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.748BB000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")e6:T717,Found reference to API "GetTickCount" (Indicator: "GetTickCount"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.74736000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74768000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.748BB000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")e7:T463,Found reference to API "CheckTokenMembership failed: %d" (Indicator: "CheckTokenMembership"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")e8:T1c4b,Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.74701000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.76501000.00000020.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp") Found reference to API "hook_LookupAccountSidA" (Indicator: "LookupAccountSid"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "hook_LookupAccountSidW" (Indicator: "LookupAccountSid"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "hook_LookupAccountNameA" (Indicator: "LookupAccountName"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "hook_LookupAccountNameW" (Indicator: "LookupAccountName"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "hook_GetUserNameExA" (Indicator: "GetUserName"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "hook_GetUserNameExW" (Indicator: "GetUserName"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "hook_NetWkstaGetInfo" (Indicator: "NetWkstaGetInfo"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "LookupAccountSidA" (Indicator: "LookupAccountSid"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "LookupAccountSidW" (Indicator: "LookupAccountSid"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "LookupAccountNameA" (Indicator: "LookupAccountName"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "LookupAccountNameW" (Indicator: "LookupAccountName"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetUserNameExA" (Indicator: "GetUserName"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74741000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetUserNameExW" (Indicator: "GetUserName"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.746E1000.00000020.mdmp, 00000000-00007376.00000000.113264.74741000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.77071000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "NetWkstaGetInfo" (Indicator: "NetWkstaGetInfo"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "LsaLookupSids" (Indicator: "LsaLookupSids"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "LsaLookupSids2" (Indicator: "LsaLookupSids"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "WTSQueryUserToken" (Indicator: "WTSQueryUserToken"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "WTSQuerySessionInformationA" (Indicator: "WTSQuerySessionInformation"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "WTSQuerySessionInformationW" (Indicator: "WTSQuerySessionInformation"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "LsaEnumerateLogonSessions" (Indicator: "LsaEnumerateLogonSessions"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74741000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "LsaGetLogonSessionData" (Indicator: "LsaGetLogonSessionData"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74741000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "NtQueryObject" (Indicator: "NtQueryObject"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp")e9:T4b1,Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.74701000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.76501000.00000020.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp")ea:T4b1,Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.74701000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.76501000.00000020.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp")eb:T400,Found reference to API "hook_CredEnumerateA" (Indicator: "CredEnumerate"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "hook_CredEnumerateW" (Indicator: "CredEnumerate"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "CredEnumerateA" (Indicator: "CredEnumerate"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "CredEnumerateW" (Indicator: "CredEnumerate"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")ec:T527,"SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\WORDPAD.EXE" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\DXDIAG.EXE" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmped:T6d2,Found string "SELECT * FROM MSACPI_THERMALZONETEMPERATURE" (Indicator: "msacpi_thermalzonetemperature"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp") Found string "SELECT * FROM WIN32_FAN" (Indicator: " Win32_Fan"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp") Found string "SELECT * FROM WIN32_CACHEMEMORY" (Indicator: " Win32_CacheMemory"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp") Found string "SELECT * FROM WIN32_PHYSICALMEMORY" (Indicator: " Win32_PhysicalMemory"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp") Found string "SELECT * FROM WIN32_MEMORYDEVICE" (Indicator: " Win32_MemoryDevice"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp") Found string "SELECT * FROM WIN32_MEMORYARRAY" (Indicator: " Win32_MemoryArray"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp") Found string "SELECT * FROM WIN32_VOLTAGEPROBE" (Indicator: " Win32_VoltageProbe"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp") Found string "SELECT * FROM WIN32_PORTCONNECTOR" (Indicator: " Win32_PortConnector"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp") Found string "SELECT * FROM WIN32_SMBIOSMEMORY" (Indicator: " Win32_SMBIOSMemory"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp") Found string "SELECT * FROM WIN32_PERFFORMATTEDDATA_COUNTERS_THERMALZONEINFORMATION" (Indicator: " Win32_Perf"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp") Found string "SELECT * FROM WIN32_PERFFORMATTEDDATA_COUNTERS_THERMALZONEINFORMATION" (Indicator: " Win32_PerfFormattedData"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp")ee:T161b,Found registry deletion API: "" in "00000000-00007376.00000000.113264.00680000.00000004.mdmp" Found registry deletion API: "" in "00000000-00007376.00000000.113264.00680000.00000004.mdmp" Found registry deletion API: "RegDeleteValueA" in "00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp" Found registry deletion API: "RegDeleteKeyExA" in "00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp" Found registry deletion API: "RegDeleteValueW" in "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp" Found registry deletion API: "RegDeleteKeyValueW" in "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp" Found registry deletion API: "WRPRegDeleteKey" in "00000000-00007376.00000000.113264.730C1000.00000020.mdmp" Found registry deletion API: "RegDeleteValueA: wrp key is mitigated" in "00000000-00007376.00000000.113264.730C1000.00000020.mdmp" Found registry deletion API: "RegDeleteValueW: wrp key is mitigated" in "00000000-00007376.00000000.113264.730C1000.00000020.mdmp" Found registry deletion API: "RegDeleteKeyA" in "00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp" Found registry deletion API: "RegDeleteKeyW" in "00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp" Found registry deletion API: "RegDeleteKeyExW" in "00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp" Found registry deletion API: "[RegDeleteKeyW] Deleting subkey %S." in "00000000-00007376.00000000.113264.730C1000.00000020.mdmp" Found registry deletion API: "[RegDeleteKeyExW] Deleting subkey %S." in "00000000-00007376.00000000.113264.730C1000.00000020.mdmp" Found registry deletion API: "NS_WRPRegDeleteKey::LogSfpKeyW" in "00000000-00007376.00000000.113264.730C1000.00000020.mdmp" Found registry deletion API: "NS_WRPRegDeleteKey::APIHook_RegDeleteKeyA" in "00000000-00007376.00000000.113264.730C1000.00000020.mdmp" Found registry deletion API: "NS_WRPRegDeleteKey::APIHook_RegDeleteKeyW" in "00000000-00007376.00000000.113264.730C1000.00000020.mdmp" Found registry deletion API: "NS_WRPRegDeleteKey::InitializeHooksMulti" in "00000000-00007376.00000000.113264.730C1000.00000020.mdmp"ef:T446,Found registry deletion API: "RegDeleteKeyExW" in "00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"f0:T446,Found registry deletion API: "RegDeleteKeyExW" in "00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"f1:Tacc,Found string "NtOpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp") Found string "NtOpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found string "[GetStringSID] Failed to OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found string "NtOpenProcessToken failed [%x]" (Indicator: "OpenProcess"; Source: "00000000-00007376.00000000.113264.74491000.00000020.mdmp")f2:T57a,Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")f3:T57a,Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")f4:T45c,Found string "INDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00007376.00000000.113264.00680000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00007376.00000000.113264.00680000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\SysWOW64\regsvr32.exe" (Indicator: "\Device\"; Source: "00000000-00007376.00000000.113264.00680000.00000004.mdmp") Found string "\Device\Mup\" (Indicator: "\Device\"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found string "\Device\PhysicalMemory" (Indicator: "\Device\"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found string "\Device\NamedPipe\ProtectedPrefix\LocalService\FTHPIPE" (Indicator: "\Device\"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found string "\Device\KsecDD" (Indicator: "\Device\"; Source: "00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.74731000.00000020.mdmp, 00000000-00007376.00000000.113264.74741000.00000020.mdmp")f5:Td10,Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00007376.00000000.113264.00680000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00007376.00000000.113264.00680000.00000004.mdmp") Found reference to API "hook_RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "hook_RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "[MoveFileA] DeleteFileA failed" (Indicator: "DeleteFile"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "[MoveFileW] DeleteFileW failed" (Indicator: "DeleteFile"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")f6:T73a,Found reference to API "hook_NtUserSetWindowsHookEx" (Indicator: "SetWindowsHook"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "SetWindowsHookEx" (Indicator: "SetWindowsHook"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "NtUserSetWindowsHookEx" (Indicator: "SetWindowsHook"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.778D1000.00000020.mdmp") Found reference to API "SetWindowsHookExW" (Indicator: "SetWindowsHook"; Source: "00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.76501000.00000020.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; Source: "00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.76501000.00000020.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; Source: "00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.76501000.00000020.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")f7:T7a4,Found reference to API "hook_AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "CheckTokenMembership failed: %d" (Indicator: "CheckTokenMembership"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")f8:Ta90,Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00007376.00000000.113264.00680000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00007376.00000000.113264.00680000.00000004.mdmp") Found reference to API "SetFileAttributesW" (Indicator: "SetFileAttributes"; Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "NtSetInformationFile" (Indicator: "SetInformationFile"; Source: "00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp") Found reference to API "NtSetInformationFile" (Indicator: "NtSetInformationFile"; Source: "00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp")f9:T5f7,Found reference to API "hook_SystemParametersInfoA" (Indicator: "SystemParametersInfo"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "hook_SystemParametersInfoW" (Indicator: "SystemParametersInfo"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "SystemParametersInfoA" (Indicator: "SystemParametersInfo"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "SystemParametersInfoW" (Indicator: "SystemParametersInfo"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.76501000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "SystemParametersInfoForDpi" (Indicator: "SystemParametersInfo"; Source: "00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp")fa:T3640,Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00007376.00000000.113264.00680000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00007376.00000000.113264.00680000.00000004.mdmp") Found reference to API "GetAce" (Indicator: "GetAce"; Source: "00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; Source: "00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "RtlEqualSid" (Indicator: "EqualSid"; Source: "00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp") Found reference to API "SetSecurityDescriptorGroup" (Indicator: "SetSecurityDescriptorGroup"; Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "MakeSelfRelativeSD" (Indicator: "MakeSelfRelativeSD"; Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetSecurityDescriptorLength" (Indicator: "GetSecurityDescriptorLength"; Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "IsValidSecurityDescriptor" (Indicator: "IsValidSecurityDescriptor"; Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "SetSecurityDescriptorSacl" (Indicator: "SetSecurityDescriptorSacl"; Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetSecurityDescriptorOwner" (Indicator: "GetSecurityDescriptorOwner"; Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetSecurityDescriptorGroup" (Indicator: "GetSecurityDescriptorGroup"; Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "SetSecurityDescriptorOwner" (Indicator: "SetSecurityDescriptorOwner"; Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetSecurityDescriptorSacl" (Indicator: "GetSecurityDescriptorSacl"; Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "GetTokenInformation failed" (Indicator: "GetTokenInformation"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "Patched an AccessCheck to ignore WRP" (Indicator: "AccessCheck"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_WRPMitigation::APIHook_AccessCheck" (Indicator: "AccessCheck"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp")fb:T4e1,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")fc:T4e1,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")fd:Tfaf,Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.74736000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74768000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74893000.00000002.mdmp, 00000000-00007376.00000000.113264.748BB000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74531000.00000020.mdmp, 00000000-00007376.00000000.113264.748D1000.00000020.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "NtTerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.74654000.00000002.mdmp, 00000000-00007376.00000000.113264.7469D000.00000002.mdmp, 00000000-00007376.00000000.113264.74893000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp") Found reference to API "NS_Shrinker::APIHook_ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp")fe:T87b,Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.74736000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74768000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74893000.00000002.mdmp, 00000000-00007376.00000000.113264.748BB000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")ff:T87b,Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.74736000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74768000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74893000.00000002.mdmp, 00000000-00007376.00000000.113264.748BB000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")100:T41f,Found reference to API "WriteFile" (Indicator: "WriteFile"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")101:T41f,Found reference to API "WriteFile" (Indicator: "WriteFile"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")102:T41f,Found reference to API "WriteFile" (Indicator: "WriteFile"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")103:T1083,Found reference to API "hook_InitiateShutdownA" (Indicator: "InitiateShutdown"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "hook_InitiateShutdownW" (Indicator: "InitiateShutdown"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "hook_InitiateSystemShutdownA" (Indicator: "InitiateSystemShutdown"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "hook_InitiateSystemShutdownW" (Indicator: "InitiateSystemShutdown"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "hook_InitiateSystemShutdownExA" (Indicator: "InitiateSystemShutdown"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "hook_InitiateSystemShutdownExW" (Indicator: "InitiateSystemShutdown"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "hook_ExitWindowsEx" (Indicator: "ExitWindows"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "InitiateShutdownA" (Indicator: "InitiateShutdown"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp") Found reference to API "InitiateShutdownW" (Indicator: "InitiateShutdown"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "InitiateSystemShutdownA" (Indicator: "InitiateSystemShutdown"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "InitiateSystemShutdownW" (Indicator: "InitiateSystemShutdown"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp") Found reference to API "InitiateSystemShutdownExA" (Indicator: "InitiateSystemShutdown"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "InitiateSystemShutdownExW" (Indicator: "InitiateSystemShutdown"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "ExitWindowsEx" (Indicator: "ExitWindows"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "NtInitiatePowerAction" (Indicator: "InitiatePowerAction"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp") Found reference to API "NtSetSystemPowerState" (Indicator: "SetSystemPowerState"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp") Found reference to API "NtShutdownSystem" (Indicator: "ShutdownSystem"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp") Found reference to API "NtRaiseHardError" (Indicator: "RaiseHardError"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp")104:Te97,Found reference to API "hook_OpenMutexA" (Indicator: "OpenMutex"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "hook_OpenMutexW" (Indicator: "OpenMutex"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp") Found reference to API "OpenMutexA" (Indicator: "OpenMutex"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "OpenMutexW" (Indicator: "OpenMutex"; Source: "00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "CreateMutexExW" (Indicator: "CreateMutex"; Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; Source: "00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp") Found reference to API "NS_SessionShim::APIHook_OpenMutexA" (Indicator: "OpenMutex"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found reference to API "NS_SessionShim::APIHook_OpenMutexW" (Indicator: "OpenMutex"; Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp")105:T95c,"SELECT * FROM MSACPI_THERMALZONETEMPERATURE" (Indicator: "msacpi_thermalzonetemperature"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp") "SELECT * FROM WIN32_FAN" (Indicator: " win32_fan"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp") "SELECT * FROM WIN32_CACHEMEMORY" (Indicator: " win32_cachememory"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp") "SELECT * FROM WIN32_PHYSICALMEMORY" (Indicator: " win32_physicalmemory"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp") "SELECT * FROM WIN32_MEMORYDEVICE" (Indicator: " win32_memorydevice"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp") "SELECT * FROM WIN32_MEMORYARRAY" (Indicator: " win32_memoryarray"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp") "SELECT * FROM WIN32_VOLTAGEPROBE" (Indicator: " win32_voltageprobe"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp") "SELECT * FROM WIN32_PORTCONNECTOR" (Indicator: " win32_portconnector"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp") "SELECT * FROM WIN32_SMBIOSMEMORY" (Indicator: " win32_smbiosmemory"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp") "SELECT * FROM WIN32_PERFFORMATTEDDATA_COUNTERS_THERMALZONEINFORMATION" (Indicator: " win32_perfformatteddata_counters_thermalzoneinformation"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp") "SELECT * FROM CIM_MEMORY" (Indicator: " cim_memory"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp") "SELECT * FROM CIM_NUMERICSENSOR" (Indicator: " cim_numericsensor"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp") "SELECT * FROM CIM_PHYSICALCONNECTOR" (Indicator: " cim_physicalconnector"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp") "SELECT * FROM CIM_SENSOR" (Indicator: " cim_sensor"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp") "SELECT * FROM CIM_SLOT" (Indicator: " cim_slot"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp") "SELECT * FROM CIM_TEMPERATURESENSOR" (Indicator: " cim_temperaturesensor"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp") "SELECT * FROM CIM_VOLTAGESENSOR" (Indicator: " cim_voltagesensor"; Source: "00000000-00007376.00000000.113264.72F13000.00000002.mdmp")106:T885,Found string "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" (Indicator: "software\microsoft\windows\currentversion\run"; in Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found string "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" (Indicator: "software\microsoft\windows\currentversion\runonce"; in Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found string "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" (Indicator: "software\microsoft\windows\currentversion\explorer\shell folders"; in Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found string "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" (Indicator: "software\microsoft\windows\currentversion\run"; in Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found string "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" (Indicator: "software\microsoft\windows\currentversion\explorer\shell folders"; in Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found string "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" (Indicator: "software\microsoft\windows\currentversion\explorer\user shell folders"; in Source: "00000000-00007376.00000000.113264.730C1000.00000020.mdmp") Found string "\Registry\Machine\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy" (Indicator: "system\currentcontrolset\control\lsa"; in Source: "00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.74841000.00000020.mdmp") Found string "\Registry\Machine\System\CurrentControlSet\Control\Lsa" (Indicator: "system\currentcontrolset\control\lsa"; in Source: "00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.74841000.00000020.mdmp") Found string "\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" (Indicator: "software\microsoft\windows\currentversion\explorer\shell folders"; in Source: "00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp")107:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC108:T785c,iVBORw0KGgoAAAANSUhEUgAABLAAAAJYCAIAAAD9hIhNAABaCklEQVR4Xuzda8xsZ3nf/9EmJq5LXUJc6nDKUxdCcAwYY8DGBj/etvEBB2LHIcYY88QYY4wDJpzLId6cjCGEc1JKKaYtcWiKUF9Eat8YLJdSlEYoivoCBWRRCbkIRRGy8qIvoins8V77un7Xuq+515o1a07fj376a933umfNmnmeh7l/3s38J5PJ533+3Oa00yY26pE+nZzo08U0pau93/s9lxEd8QGOee1rCdnR3Hyzy2tekyV/rJy95RaX170uyTcArJR+LAIYHYVwHBRCFMRdMiE7EgohAAohsAYohOOgEKIg7pIJ2ZFQCAFQCIE1QCEcB4UQBXGXTMiOhEIIgEIIrAEK4TgohCiIu2RCdiQUQgAUQmDlDh1y6eYJPi90edvbXHSxd+utLpPHuHz+8y6TyWEb7XiHfCafs8kvNZl8xeevfP7a50GX/YnL5Ac+P/R5wOc7PrL4fp+/cdHn/ZaPPPb7aeSufuSiT/RNn79w0cXyin7s429DHytve774Lp8v+tzjoo/1b6y+G9/28a93cr3L4yZZTvG57TaXN7zB5Y1vzCKLb7/dRf42JG99q4v8xb7jHS7velf/yKU6RS71nvd0yHvf63LHHS7ve1+WD3zA5UMfcvnwh10+8pG1yB/8QZY//EOXj3/c5ZOfdPnUp1w+85kO+aM/6hB57Gc/2yHyWLnnT3zCRV6+P6ub0y4mAABsOgohhdBE7upoD6QQUghjMeuUWPPqI5eKrS8JhZBCSCEEAGAuCiGF0ETu6mgPpBBSCGMx65RY8+ojl4qtLwmFkEJIIQQAYC4KIYXQRO7qaA+kEFIIYzHrlFjz6iOXiq0vCYWQQkghBABgLgohhdBE7upoD6QQUghjMeuUWPPqI5eKrS8JhZBCSCEEAKDCZT6j+ZLPR31yruNNDvkGmH736Z13uvy0ivq810cK4Wrcd5+L+jkfqbiPnbjIeyVnc4/y6WSRx3Zyvs8iv977Uhc7OdLhS2Vla/6xj7nItl46wF13uUhRkRojJeeDH3R5//tdjhxxkTYlXSuWMZt3v9tFOt473+ny9re7SE2VSKd985uzvOlNLlKepVpLS3/9613kayrz77eUL8N89atdbrzR5eDA5YYbXK6/3uW661yuvTbLy17mcs01Lldf7XLVVS4vfanLlVe6XHGFy2WXubzoRS4XXdQhl1zicumlHXL55Vlk8Qa6A9Wm/3NC1jzrY8H/ymP/O1HNpUr/Xak0DyzPAjvmhVAIa1EIO6AQUghLoRBSCCmEOynWD7JumWtWkBp62sjPNkoXnPvwfEHvS8XFcQZYqgV2zAuhENaiEHZAIaQQlkIhpBBSCHdSrB9k3TKXtKOkLCWnrNIF5z48X2DP5isn8xbHGWCpFtgxL4RCWItC2AGFkEJYCoWQQkgh3EmxfpB1y1zSjmbDOGm1ztvJ5tgOZU2jNGPJpB3GB9oZq3nIbI0dAku1wI55IRTCWhTCDiiEFMJSKIQUQgrhTor1g6xb5mptSpWTzYwcP7zCD0uL44JITpUe3nopeexM6ySwBvZ8xP4CG2htNakTfUazquf1Di3yxbCd3udFPDKr5dKXHvWoic0ce+kvodjrsji31+VSe10Wy445z8UXuxw+7HLhhVkuuMDlhS90Oe88l3PPHSzPf37/nHNOluc+1+Xss13OOsvlmc90efrTs8jiM8/sEHneuKA+cqlOedaz+kdefqfEN3OonHFGltNP7524PSWEjJm5Zj2qYedLB/nw4Qsd07qgmUzmrcqHtM63XrZ1ElgDe+k2d59COAYKYfZLKPa6LM7tdbnUXpfFsfUloRBSCCsTa159Ys2rT3wzh0osgRRCQrYic83tVPGgGYrWZY3SgtK8lTxEyAI5brROAmtgL93m7lMIx0AhzH4JxV6Xxbm9Lpfa67I4tr4kFEIKYWVizatPrHn1iW/mUIklkEJIyFZkLqlGsUq1tqw4bMydL12n9MBJODX3IXa+dU3rJLAG9tJt7j6FcAwUwuyXUOx1WZzb63KpvS6LY+tLQiGkEFYm1rz6xJpXn/hmDpVYAimEhGxF5ip1rdlx0qxKZ2VZwy4oHc8OWtmzrQ+X+TiZzABrYy/d5u5TCMdAIcx+CcVel8W5vS6X2uuyOLa+JBRCCmFlYs2rT6x59Ylv5lCJJZBCSMhWZK5Zp2rEs/ZY1jQzMtkcWzUPlBlLVtrj+MDWBa1ngfW212XXux6+9CWXn27GfXJ/7LOIIz4Z+f6/8UrdNrjPJ3Wqz2jC9jTLr/3aavK0p61FfuVX+ufJTx4pp52WZW/P5YlP7JAnPKFDHv/4wfJLv9Qh//yfj5RTTnGJC5I87nE2cXtKCBkzC1qf7iSlrrehrgOMYo9C2NsRCuEo7qMQDpPYzVaSWPPqE5vbkhJLIIVwGaEQErItWQTFCVi1PQphb0cohKO4j0I4TGI3W0lizatPbG5LSiyBFMJlhEJIyLakH/4ZDVgPexTC3o5QCEdxH4VwmMRutpLEmlef2NyWlFgCKYTLCIWQkG0JgE22RyHs7QiFcBT3UQiHSexmK0msefWJzW1JiSWQQriMUAgJ2ZYAAJDa7/LttY/22Qh+b7rEyJ5Y9tOd8tjHdsipp7rEBUl+8RddfuEXRoo8r9yVvCKpT7HI1eeXf9kl9sn6/It/0SFPepJLXFCff/kvNy5xe0oIGTMAAKT2KYQDhUJYHwph74S6tf6J21NCyJiZa/Z/Ljj7vxjkeLXHALAK+xTCgUIhrA+FsHdC3Vr/xO0pIWTMAACQ2qcQDhQKYX0ohL0T6tb6J25PCSFjBgCA1D6FcKBQCOtDIeydULfWP3F7SggZMwBWTTbQ+10235NP+myE631+5PMXPj/xkcWdXOZy4sSlk/1OPyPvUT6dbP23m+53emPl+0vl9+qHPg/6+LNhe5rlKU/pkKc+1UW+sfOMM1ye8QyXM890Oeus/nnOc1ye97z+Offc/jnvvP45//zVJN5Jkuc/v3/i1ZK84AUuL3yhy/6+y+HDLhdf7HLJJeuQuD3d8nzta4SsVfQD1pumdDWAPiiEFMJKFEKHQlgdCmHvxDtJEmtefeLVklAINz1hO07IaqMfsJ5WQE9Xt6lcb5c1K1snga1DIaQQVqIQOhTC6lAIeyfeSZJY8+oTr5aEQrjpCdtxQlYb/YD1pJIJXd2mWZavbz3bOglsHQohhbAShdChEFaHQtg78U6SxJpXn3i1JBTCTU/YjhOy2ugHrOcLoNLVgayZDWsmZ1onga1DIaQQVqIQOhTC6lAIeyfeSZJY8+oTr5aEQrjpCdtxQlYb/YD1bP2LdHUga5phcmC1TgLb51s+HVx9tctiheGITxeLlCvpw1uo0xsri/OSI+X5uz4P+HT5NTvVZyH3+XSxyO9zp5dw6aX9c9llHRIfbiO75IsucpFdfqdIYYi1pz6xySSRx8aKaBOfq/fzbmLOOcclLkgWP/e5LtL/5b8OPOtZg0X+m8Uzn+kS19ucfbZN3J4SQsaMfix6tv5FujqQNc2w9cBKJoHt02Wn7lEIN0GnN1YWUwj7/j53egmxm9Untr4k8eE2FMIk8eJbFgohIWR10Y9FTyqZ0NWBrLFDuULr1Vonge3TZafuUQg3Qac3VhZTCPv+Pnd6CbGb1Se2viTx4TYUwiTx4lsWCiEhZHXRj0XvePlro6sDWdMMkwOrdRLYPl126h6FcBN0emNlMYWw7+9zp5cQu1l9YutLEh9uQyFMEi++ZaEQEkJWF/1Y9Gz9i3R1m2aZXR8nW6/WOglsny47dY9CuAk6vbGymELY9/e500uI3aw+sfUliQ+3oRAmiRffslAICSGri34serb+Rbq6TVwvD5wNW6/WOglgHXQqOR/02XGX+SzPAt9Amzexk3yU/2LY/YnLHP/F5ZETl9whn05kA50nfvFmfWRbHxdsWaSo5PENQfuDlA35gtbTT3d5qv9y1/jtr0ni98r2zt5e//zyL/fPE56wcYnb0+2O/k/Qtvveivzqf/2/pDL6MwOACkcohH1RCBMUwu1KbH1JKIQ2sebVJ9St9U+sTNsd/Z+gbadFbSyx9pBS9GcGABWOUAj7ohAmKITbldj6klAIbWLNq0+oW+ufWJm2O/o/QdtOi9pYYu0hpejPDAAqHKEQ9kUhTFAItyux9SWhENrEmlefULfWP7EybXf0f4K2nRa1scTaQ0rRnxkAVDhCIeyLQpigEG5XYutLQiG0iTWvPqFurX9iZdru6P8EbTstamOJtYeUoj8zAABW4hnPcAm99DdcOtXFU3zkUmF72iFPepJL3NnX57TTXJ78ZBcpOXme9jSXX/s1l6c/vUPkpyJfLPnsZ3eIfN2lNMBYEZN0+k7OPPEbTW06fUHreecNlvw29vc75PDhZeXii/vHf8Vu3J4SspvRUjsW/dAEAGAlKIQUwtpQCOszK2/LSKx59aEQEtIWLWpj0Q9NAABWgkJIIawNhbA+s/K2jMSaVx8KISFt0aI2Fv3QBABgJSiEFMLaUAjrMytvy0isefWhEBLSFi1qY9EPTQAAVoJCSCGsDYWwPrPytozEmlcfCiEhbdGiNhb90AQwthN9crqvfcBlztc/evmlHjVxyemlfuhyqNPXP/7Ax19q8iKfnFzKv8CTJy45fYHX+OTkS1bv8fmsj1+cv3X52UWc6tPN3/rc4nO9z4GPnL3ZRxbL2Rt9fs8ndfnlLi9+sctLXuLy0pe6XH21yzXXuPzWb7lce63LddcNluuvz3LDDf1zcOBy440d8upXu9x8c4fccovL617XIa9/vcttt3XIG97g8sY3urzpTS5vfrPLW9/q8va3u7zznS7vepeLnJXHvu1tLvK8cvYd73CRS73lLf0jzyuRxfJuSPw96+YU2yXWHrJu0Y9FAGOjEDoUQpP8rcvPLoJCSCFsQiGkEDaJJdBGFscSSCHcVbF+kHWLfiwObWroOa+0sjQPbAsKoUMhNMnfuvzsIiiEFMImFEIKYZNYAm1kcSyBFMJdFesHWbfox+LQmhY3t86VVpbmgW1BIXQohCb5W5efXQSFkELYhEJIIWwSS6CNLI4lkEK4q2L9IOsW/VgcVGu1q59M5oEtQiF0KIQm+VuXn10EhZBC2IRCSCFsEkugjSyOJZBCuKti/SDrFv1YHFSpziUHlfPAzpjT8b7r08U5Pt3ahRSzf/DJPOYxLh2f9zKXbo+Ve5Zi9iMfKaJ/7fN9n+/4POjTn+z5w7du5o74dCLv1Z/5yFvnfPe7Lt3uec+nG7nnj/vIS/i0i+yn4z7YJl8sW+Tf+z0XORt3yeUds27r88Sr2cQXVR95RXmkPnU6G/tG8sYOmNtv7xB5rLwiiXRLaZ4Sqam33uoibfk1r8kii+VSkvx5JbGK903cnhJCxox+og6qVOeSg8p5YGdQCB0KYXW5ohBSCEuJL6o+sUElyStffjaWwOSNHTCx9SWRx8YSaEMhLCduTwkhY0Y/UQeV1LnpUa2n7LA0D+wMCqFDIawuVxRCCmEp8UXVJzaoJHnly8/GEpi8sQMmtr4k8thYAm0ohOXE7SkhZMzoJ+qgSnUuOaicB3YGhdChEFaXKwohhbCU+KLqExtUkrzy5WdjCUze2AETW18SeWwsgTYUwnLi9pQQMmb0E3VordWufjKZB3YDhdChEFaXKwohhbCU+KLqExtUkrzy5WdjCUze2AETW18SeWwsgTYUwnLi9pQQMmb0E3VoU6OZkQXNgazM54GtcZdPB//v/7l023xP/ptPJ7L5/qCP1NQHfL7pM5ZOb45WTd8ufnXiknuMzwL+/u9dJpMrfG728c7wyenL76LT99OKTj8jscg9y465U+LXYyaRnfpNN/VP/ErP+vzO77jI14rKN5S+4hUuL3+5y8te5iJfsipnO0Uu9Zu/6SJf3yqRx3aKfG3sVVe5/MZvdIh8Ia1cqtOV5eXnyV+CfGtunngnNvICOz3WJ25Ptzv6LZxdTP/H/yFk8OjHIoDRUQhH0enN0XZBIaxGIUxCIayPXEo6TyyBFMIm+UuIrS9JvBMbCmHfaMnrIm7lCVk8+rEIYHQUwlF0enO0XVAIq1EIk1AI6yOXks4TSyCFsEn+EmLrSxLvxIZC2Dda8rqIW3lCFo9+LAIYHYVwFJ3eHG0XFMJqFMIkFML6yKWk88QSSCFskr+E2PqSxDuxoRD2jZa8LuJWnpDFox+LAEZHIRxFpzdH2wWFsBqFMAmFsD5yKek8sQRSCJvkLyG2viTxTmwohH2jJa+LuJUnZPHoxyKAsZ3s08mqNtCP9BnQKT5ikXvOzakxV/uIi328OVf+qo+4zcebc+W/9RHpldOfguw2xfnnu6j0ykeOuIg5V36Cj/fQQy5KtqfyCvPInlhy5ZUdEh9uEytEfcL+2yVf/Ou/7vLiF3fIFVdkiett5M25/PIsl17qkp/Nc9llWeJT10deoNSn+PtQH/kZyU8w/tLaxN8Wm7i+PrFs2/gOH7enhJAxox+LAMZGIbTSwrDQPefmlCsK4XGy6xNzalt6ZQphlrhZr4+8QEm+mEJIIeyXWAIphISsa/RjEcDYKIRWWhgWuufcnHJFITxOdn1iTm1Lr0whzBI36/WRFyjJF1MIKYT9EksghZCQdY1+LAIYG4XQSgvDQvecm1OuKITHya5PzKlt6ZUphFniZr0+8gIl+WIKIYWwX2IJpBASsq7Rj0UAY6MQWmlhWOiec3PKFYXwONn1iTm1Lb0yhTBL3KzXR16gJF9MIaQQ9kssgRRCQtY1+rEIYGR//ucuQ1pefcqvvMjZPR/xDJ9OTvIR+V3lZydfctmfuCzg5JNdJmf6TA58vLR6zXlFp/mog+x502I2OctHHWRXzl/RY/Jvcz3Iruz3ppPf/u0s8fswbeJ6m+uuW1bkq0El8j2ikle9almJz1UfudTBwWDJryxfwdop9qtc1zbyVbdxwSoSt6eEkDGjH4tqmmZZptP2i5fmgQ1GIXT2KITHUQid/BVRCJPEupVUrwETn6s+cqmDg8GSXznWvPqEnrOOoRASQkL0Y1HFErhQIcwbXXO2tKw0n5ge1TqZn7IzcgAMiULo7FEIj6MQOvkrohAmiXUrqV4DJj5XfeRSBweDJb9yrHn1CT1nHUMhJISE6MeiiiXQZllK1as0n4itLxm2HscDYEgUQmePQngchdDJXxGFMEmsW0n1GjDxueojlzo4GCz5lWPNq0/oOesYCiEhJEQ/FlUsgTaZ1t4ljUvamq1eVlwga5pJ0ZwqXcSaO19aACyEQujsUQiPoxA6+SuiECaJdSupXgMmPld95FIHB4Mlv3KsefUJPWcdQyEkhITox6KaFb9SMlKfZsPWchUnbc2T49bJ5ljEB8qxNXe+tABYTL7NnRz2cW691UWd46OyK3/+8y5B9tg538n5OJ9D0kyu9BE3+nhSNvTKL/MR1/t4j/VR6V3lV/4VH/UWH+9El0OHXHbN6ae7dBO2p1liDbCJ9aO+bMRCZRMrU31iRbSJ9dLm5S/PIo1XvkkyFub68iwt/Td/0yV+H2Z94ves2siXf3b6LtD4Tao28TtL6xO/s9TmRS/KcvHFWS66KMuFF2a54IIs8r3AkvPOs4nbU0LImNGPRTVNM0esUvHAKp2N86UFIlnfsJNmyXGliwADoRDaUAgdCmEtCmGWWAIphKXEEkghLCWWQAohIZsZ/VhU0zRzxColBaxUyaR6xfnmsY3jq4+RydY1k7aLi7kLgMVQCG0ohA6FsBaFMEssgRTCUmIJpBCWEksghZCQzYx+LKppmjlilWrtVPFsqcvFg8Q00BVHNfO9FwCLoRDaUAgdCmEtCmGWWAIphKXEEkghLCWWQAohIZsZ/VhUs+JXynzSxFrLVZy0j5LjOGnnLZmMF4nD1uN4AAyKQmhDIXQohLUohFliCaQQlhJLIIWwlFgCKYSEbGb0Y1FN08yXNLfZqdazzanSAlnTTNqzOlW4vl8y566aSWA4flu/GbRreVLMBrSJ71Va+WSPNKRNfK/y36vJxT7D8XvTyTnnZHne8/rnOc9xefazXZ71rCzPfGaWpz/d5YwzXJ72NBc5K4kXt4k3ZnP22f0T3y6bc891ef7zs7zgBS5SVA4fdpEKdMklLpdemiV2Mxupi9ItpYhefbVLXq1jf04iDT/+FwEb+U8J8l804n8fsbnpJhf5OtNbbnF53ets4vaUEDJm9GMRwNi2b+NOIbQohPXy3ysKYRIKIYWwFAohIWRe9GMRwNi2b+NOIbQohPXy3ysKYRIKIYWwFAohIWRe9GMRwNi2b+NOIbQohPXy3ysKYRIKIYWwFAohIWRe9GMRwNi2b+NOIbQohPXy3ysKYRIKIYWwFAohIWRe9GMRwCZ7h8/nfR7w+bbPj32+6/MXPu/2EX/p83c+f+3zI5+f+Py9z4HPjT7yfZ7yAuUVScRHfcTf+Dzo8y0fedt/6CO3IW/ON33EPT4P+chdyfssP1B5ReKLPnJX/9tHrizvhtyGkJ9g/tj8jRX3ZO/V61/vctttHfKGN7j87u+6yNnbb8/ypje5vPnNWd7yFpe3vtXlbW9zefvbXf7Vv3J517tc3vMel/e+1+X3f9/ljjtcjhxxkbPve5+LLJazH/iAywc/6PKhD7nceadLfvbDH3a56y6Xj37U5Q/+wOVjH8vyh3+Y5eMfd/nEJ1zys/mlPvnJDvnUp1w+/WmXz3ymQz77WRc5K1eW+NuI29P6/OBP/zshZMHoZyaATUYhpBA2kbuS91l+oBRCCiGFkEJIISRkR6OfmQA2GYWQQthE7kreZ/mBUggphBRCCiGFkJAdjX5mAthkFEIKYRO5K3mf5QdKIaQQUggphBRCQnY0+pkJYJNRCCmETeSu5H2WHyiFkEJIIaQQUggJ2dHoZyaA0T24wMZdNtBf9vmxz/d95ImkisgTyW3I897pIzt1udQPfOR5pSDJ88qmX3b5+eK/9ZHn/ZaPXOpBH3Hn0l7+/T75j0yeV37c8rshLzB/XmnpA96VvLHv95ErS+TnK8/7TZ8f+/hLyRY53zHnkc23bOslcbNuI5t+qQRSVCR5q5Gzko98ZB0jtU0iHS+vfItcuVPzlLN58taa34acja/CJr63NvlvTv6LFK9WfeW4PSWEjBnd14hpmtWZTtufvjQPrDPZE8uuVzbu0i4ohDb5YgqhjbzA/HkphNWhEC4psdjYxMqUFKRFrpxXvvxsnrzj5bchZ+OrsInvrU3+m5P/IsWrVV85bk8JIWNG9zVimmaeHvUsf0hztrSsNJ+YHtU6mZ+yM3IAdCJ7Ytn1ysZd2gWF0CZfTCG0kReYPy+FsDoUwiUlFhubWJmSgrTIlfPKl5/Nk3e8/DbkbHwVNvG9tcl/c/JfpHi16ivH7SkhZMzovkZM06xOqXqV5hOx9SXD1uN4AHQie2LZ9crGXdoFhdAmX0whtJEXmD8vhbA6FMIlJRYbm1iZkoK0yJXzypefzZN3vPw25Gx8FTbxvbXJf3PyX6R4teorx+0pIWTM6L5GTNPMI01pVr1K9alZY2fsenu2OVVaIGuaSdGcKl3EmjtfWgDkZE8su17ZuEu7oBDa5IsphDbyAvPnpRBWh0K4pMRiYxMrU1KQFrlyXvnys3nyjpffhpyNr8Imvrc2+W9O/osUr1Z95bg9JYSMGd3XiGmaeWxTio1L6pNMxvVyUDpunWyORXygHFtz50sLgJxszYXs42VfO2DHW6TVdGoIslOXs9JM5Kxc+SGfFdUJfSfFX67oO1fFPT7y1kkxy1+g/DLIfx34mo88Vt5Y8UkfuQ2J/BLmv8DpX4psc+O3RybfJCln46a5/sp54tWSyOY7T75xX15iZxgq+RPlZ/N0Kld5YlUb6sp54g9iJfG/sXF7SggZM/ppLKZp5ik1pTifHFils3G+tEAk6xt20iw5rnQRoFJeJ75MITSRKz9EIaQQUghbEvffSVZVGGJXGSr5E+Vn8wxY22IJHOrKeeIPYiXxv7Fxe0oIGTP6aSymaeYpNaU4Hw9mx6VKVnNBcXz1MTLZumbSdnExdwGQy+vElymEJnLlhyiEFEIKYUvi/jvJqgpD7CpDJX+i/GyeAWtbLIFDXTlP/EGsJP43Nm5PCSFjRj+NxTTNPKWmFOfjgRXP1l8wMQ10xVHNfO8FQC6vE1+mEJrIlR+iEFIIKYQtifvvJKsqDLGrDJX8ifKzeQasbbEEDnXlPPEHsZL439i4PSWEjBn9NBbTNPOUmpIdShNrfUictI+S4zhp5y2ZjBeJw9bjeAB0kteJL1MITeTKD1EIKYQUwpbE/XeSVRWG2FWGSv5E+dk8A9a2WAKHunKe+INYSfxvbNyeEkLGjH4ai2maeUpNSWpVa8tqTrWebU6VFsiaZtKe1anC9f2SOXfVTAL1ZMcsHUA2weI7PnIpeezXfWQD/WMf6UsSeaJ0t60W2fR/2UduQ1qNPPaBtCHIY+XKYpG3fU1ewj1j9cM7054m/V8iT/QtH7krqdZd3qtYqOoju+24wCZui+sTr2aTb/rz24hXSxKbqk3elvPkj83Pxvu0iW9mkvjw+kvF9mUTW59Np28KHTCdbnKRxO9KNYnbU0LImNE9AoDRya6XQmhDIVzSS7iHQng8cd9fH9lPxwU2sULUJ17NRm4jf2x+Nk8scvW1LU/+2PxsvE+b+GYmiQ+vv5T8FCSxIyV9KS5YUjrd5CIJJZBCSMj6RPcIAEYnu14KoQ2FcEkv4R4K4fHEfX99ZD8dF9jEClGfeDUbuY38sfnZPLHI1de2PPlj87PxPm3im5kkPrz+UvJTkMSOlPSluGBJ6XSTiySUQAohIesT3SMAGJ3seimENhTCJb2EeyiExxP3/fWR/XRcYBMrRH3i1WzkNvLH5mfzxCJXX9vy5I/Nz8b7tIlvZpL48PpLyU9BEjtS0pfigiWl000uklACKYSErE90jwBgdLLrpRDaUAiX9BLuoRAeT9z310f203GBTawQ9YlXs5HbyB+bn80Ti1x9bcuTPzY/G+/TJr6ZSeLD6y8lPwVJ7EhJX4oLlpRON7lIQgmkEBKyPtE9AoDRyQb6Hh+pBPkWWfbE8uWfstuWxfINlvJE3/YRX/CR55XCIFf+qk9+zz/2kUvduZbdQyxSJqVLy2PlrZMfmSyWhv+gj5Czne750z6yWC4lvyqLOOzzJR8v37neeadL2Mt2iFxKnjdWiN6RK3fqLXnye87Pyrshi+Pblbx1i0Su/KEPuXzwgx3ygQ+45Gff/34XOZun05XzvO99We64o39+//ddjhxxkbP+sXF7Sgjpmvs/8ie9ox+LAEZHIaQQNpEnknJFIaxHITShENrIlSmEFEJCtiKx5tVHPxYBjI5CSCFsIk8k5YpCWI9CaEIhtJErUwgphIRsRWLNq49+LAIYHYWQQthEnkjKFYWwHoXQhEJoI1emEFIICdmKxJpXH/1YBDA6CiGFsIk8kZQrCmE9CqEJhdBGrkwhpBASshWJNa8++rEIYHSyNRdSNsT/9hGy2xbSeYRs3MVdPkL6ksi7R35X+bvxtz4ifzfyn8JDPqnn+sx5RYvc83U+4iYfceAj8sfe6iPyu8ofe5De1e0+4jYf75CPeO97XWTn+p73uORnJe9+t4s80bve5SKL5Wy+WCK3Ic+bv16/U9dtfawQSWKDspEmJrVNzkpiY0yS11Rpy/HrT5MvO/34x13i+iT596bmT/SJT7h8+tMd8tnPZvnjP3b51//a5d/8G5fPfS5L/lifuD0lhIwZ/Vj0ptMsAAaRV5G8AlEIrUXKVf5ToBBaeanL7yp/7EF6VxTC8mKJ3EYsgcnrpRAmyXtaXJ+EQkghJGRtoh+LXiyBa1IIp0e1Tuan7IwcAKuSV5G8AlEIrUXKVf5ToBBaeanL7yp/7EF6VxTC8mKJ3EYsgcnrpRAmyXtaXJ+EQkghJGRtoh+LXiyBa1sIk2HrcTwAViWvInkFohBai5Sr/KdAIbTyUpffVf7Yg/SuKITlxRK5jVgCk9dLIUyS97S4PgmFkEJIyNpEPxa9WAJt5pp1rVl5i4Utzs+O47xoTsXHRnPnSwuA0eRVxPafB/QkhdBZpFzlPwUKoZWXuvyu8scepHdFISwvlshtxBKYvF4KYZK8p8X1SSiEFEJC1ib6sehJA5TMJb3OdrC5x7Nhc2zZ9XFSzJ0vLQBGcvbZLgcHLl/5isuJJ7pMJi+yOf30ic0NN7jId1SefPLE5sEHXS67zGUyudjmbW+b2Mh+Q3Z9+/su6tEut9/uEr779L/5fNXlrInL5Bab++6b2JxyisvkkT77PkLaxYk++z6yWOJfvuTGG11+Wlx8vu7y0/8psznN5c/+zGVyis/kLS7yinJP9vHPq5fa9xFyqdN9FrmU/G6c5PNv/63L5z+fRfay+WPlrDw2XtzmC19wkUv9u3/nIou/+MUsd9/tEhfYyBPlyV9vHnn5sWD0LRt6V/k7KZH36ktfcvkP/yHLf/yPWf7kT7Lcc08W+WD40z91+U//Kct//s8u8j8NcX0SuQ25SXlF8R0w+fJtH96p3PmSWwlZq+hnqGfrX8xc0rVKHWzuvEjWN+ykWXJc6SLA2CiEFMJSKIQUQgpheyiEFMJNTtyOE7La6GeoZ+tfzFyxsPWeb2peaY0oXbMxdwEwEgohhbAUCiGFkELYHgohhXCTE7fjhKw2+hnqNd2vNXOVylvXeZkUuuKoZr73AmAkFEIKYSkUQgohhbA9FEIK4SYnbscJWW30M9STBiiZS7qW7WCl49lB67B1suaxrcfxAFgNCiGFsBQKIYWQQtgeCiGFcJMTt+OErDb6GerNil8pc+UlrdG6IA5bZ+xk6zXllJ2RA2BF9n1+zueQzxPSSKOQxwpZPKDzffLbyM9OvuIib84ZPpOv+fzQ536fH/h8wecBn+/7fNTnJz7ytaLyTaHyvPJtrvIFrflt+Ddn8lc+8vLlUn/n86DLnB9K5ic/cZH/ZqGr14RsT//9v3eRSiCFQZrYIq3mj/7I5TOfcZH/7iL51Kdc5Fso8y+0lK/ZlC/hlMg3dsr3eco3heZfHCr/6ej973eRbzfNv9xVvoL1ne90efvbXd76Vpc3v9nlTW/qEPkvWG94Q5bbbsvy+te7vO51Ljff7PKa12R59as7RP6zk0QW33RTlngnNq99rYt/RXF7Ssjm5nsbSD8WAYxt34dC6FAIk9ugEA6EQkghpBC2RhbHEkghJCTkp/3K/hPaRgz1YxHA2PZ9KIQOhTC5DQrhQCiEFEIKYWtkcSyBFEJCQvLqtZ5D/VgEMLZ9HwqhQyFMboNCOBAKIYWQQtgaWRxLIIWQkJC8eq3nUD8WAYxt34dC6FAIk9ugEA6EQkghpBC2RhbHEkghJCQkr17rOdSPRQBjk1I3ucyni30fLMsCP6Mhfd3nTh9pgNIP7/L5bprP+0i1lhIrrVX8jY8votql85cgTVtyvc+3ffwLlN32Lbe43Hqri2zc8229nP3d33WRwiDtQvLGN7rIleUmpU6ke3GNLI47e5u8P8jZV73K5ZWvdHnFK1yuu87l2mtdXvYyl2uucbn6aperrnJ5yUtcrrzS5Yor+ke+nfmSSzYgF13kcuGF/XPBBb3zPQArpZ/VAMZGIdw8C/yMhkQhTEIhpBBSCCuyNoUw+beLpQ5RL38n8+Ei8itvxHD96Wc1gLFRCDfPAj+jIVEIk1AIKYQUwopQCFEtfyfz4SLyK2/EcP3pZzWAsVEIN88CP6MhUQiTUAgphBTCilAIUS1/J/PhIvIrb8Rw/elnNYCxUQg3zwI/oyFRCJNQCCmEFMKKUAhRLX8n8+Ei8itvxHD96Wc1gNHJ5nswU28yucLH20/L5J4PsE3C9pQU84IXrEWe/3yXc85xee5zXc4+2+Wss1zOPNPlmc90OeMMl9NPd3nqU12e8pQsp53msrfn8sQnujz+8S6nnury2Me6nHKKyy/8gss//acu/+SfuJx00rJy4okuJ5yQRDenAMalH4ub5htH6WxHpSs086UFjUFuAzuLQgisVKw9pJTYzVYSCiGFsNpPP/ya6DkAR+nHYjCrOpau8OYuGFanpystnjtfWmDVrAFaUQiBlYq1h5QSu9lKQiGkEFajEAJz6cdi0LXndF2/oEGernQRCiHGQSEEVirWHlJK7GYrCYWQQliNQgjMpR+LQannzOa/cUwzGWea+dIamWzm7YI4jDPmAj+bt8fNAnts5fOlBc1kc0pmgBoUQmClYu0hpcRutpJQCCmE1SiEwFz6sRiUSo40ouZY1sdldmV+3Mw083YYZ+yw9dgedD1unWyOmxk7BABsgkc8IguAJdPNKYBx6d9kMKs9VjMvy/L5fDh3XhbMlB5VOo4HXedLC1qHAIBNEEsghRAYkW5OAYxL/yaDUskpdaHSfD6cOy8LZkqPKh3Hg67z3wgeXuqXAQA2RyyBFEJgRLo5BTAu/ZsMSiWn1IVK8/mwNN8cy4KZuY+S43jQdV4WiPwsAGAtxRJIIQRGpJtTAOPSv8mgVHLmdqfS0K6cexyHQlbmx/ag63GctPNyDADYHLEEUgiBEenmFMC49G8ymFUgq5mXZc1Bsmw2I2tk0s43Z2WmYU/NPZZJK58vLWgmZ/N2CAAAgPl0cwpgXPo3uSJ5m0rOxmK2EmtyGwAAABtGN6cAxqV/kyuStKnkFAAAADabbk4BjEv/JlektfXxz24AAABbTjenAMalf5MAAADAaHRzCmBc+jcJAAAAjEY3pwDGpX+TAAAAwGh0cwpgXPo3Gcz+D/lm/7d8HK/2GAAAYNvo5hTAuPRvEgAAABiNbk4BjEv/JgEAAIDR6OYUwLj0bxIAAAAYjW5OAYxL/ybFs5+dZUTTo3R2o2zBSwAAABiYbk4BjEv/JkUsgR0L4awF5V2oco1ODU2eohmW5ntY5LEAAABbSDenAMalf5MilsDuhVAOhJ1POmFpfkClpyjN9zDgpQAAALaBbk4BjEv/JkUsgV0KYY9/W2td03od2x5nx3ZGJu28nEpmkvnSo5oFcd6eBQAAwM/o5hTAuPRvUsQSuB6F0M7Y4YLHswMZJvNzj2fD5jgOAQAAdppuTgGMS/8mRSyByyyEpQX5dUrDdZtvHQIAAOw03ZwCGJf+TYpYApdWCJOz+XWmQWlZcyBkgQyHmm8dAgAA7DTdnAIYl/5NilgCl1MIk1OTcDYfNkrLFlzfe751CAAAsNN0cwpgXPo3KWIJ7FIIJ4Wa1KMj5Q9vPWvnS8ezoRzUz5eOZwdxKKcAAAB2nW5OAYxL/yZFLIHdC2HDTrYumGlOWXY+rml9uJ2083IqTjbDfN6eksnmWIZyCgAAYNfp5hTAuPRvcl1J6arRdf2y9XgJAAAAW043pwDGpX+TW4T2BQAAsO50cwpgXPo3uUUohAAAAOtON6cAxqV/kwAAAMBodHMKYFz6NwkAALC1HvGILCec0D8nntghJ5205XnUo7KcfLKNbk4BjEv/dxIAAGBrxRJIIVxGYgmkEALrSv93EgAAYGvFEkghXEZiCaQQAutK/3cSAABga8USSCFcRmIJpBAC60r/dxIAAGBrxRJIIVxGYgmkEALrSv93EgA21SEfsefTyZk+qUOHXLZQ/j7nZ+c48MkM+T77vemcPPrRHfKYx2x5TjllWXnsY/vnl37J5fGP75AnPcllb28DctppLk9+sstTn9o/T3taljPOyPKMZ2Q580wb3ZyO5V4AR+nHorjjjiwjmh6ls93NvchQTwRgdHkV2fPphEJo5e9zfnaOAwrhhiUWuaESa159KIQUwjo/2wf/dMt3LLswXJX8rrZvuCr5XSXDOWIJ7FgIZ/0qaVl2QWnN5Ogyneql5jo1awCsn7yK7Pl0QiG08vc5PzvHAYVwwxKL3FCJNa8+FEIKYZ18i7yVw1XJ72r7hquS31UynCOWwO6FUA5EaV5ULpur5jo1awCsn7yK7Pl0QiG08vc5PzvHAYVwwxKL3FCJNa8+FEIKYZ18i7yVw1XJ72r7hquS31UynCOWwC6FUJpVa9FqnRRxzdF/TfyZ1slk3p5qnWxOyQyAtZdXkT2fTiiEVv4+52fnOKAQblhikRsqsebVh0JIIayTb5G3crgq+V1t33BV8rtKhnPEEriEQpgUs5l4nWbGHgxy3MzYIbB7FtrW5z7p08l/8Tnik/ucy89NXNZUfs+3+HTyVR9xj4/4uo/Ir/xRH/FlH5Hf1ad9xBd9PL83nZx1VpbnPCfL856X5dxzs5x/fpYXvnBZ2d/vnwsvdIkLeufwYZeLL3a59FKXyy/vkBe/uH/i1Wwuu6x/LrmkQy66aLDEi48T/xOUTS2AkenHoogl0Gaeri0rFrNmPhm2Ttqy12m+dQjsnkMUwnWQ3zOF0KIQ9k0sY/WhENrEmlefWJmSxF7XO/Hi48T/BH+2H/3pvutYNmW4Kvldbd/we9PvNWG4pKF+LIpYAm3m6dGyWtfUXKe0JpkXrcuAXXWIQrgO8numEFoUwr6JZaw+FEKbWPPqEytTktjreidefJz4n+C9oQNsxHBV8rvavmFSYxgONdSPRRFLoM08PVpW65qa65TWVM6L/CywAw5RCNdBfs8UQotC2DexjNWHQmgTa159YmVKEntd78SLjxP/E7w3dICNGK5KflfbN0xqDMOhhvqxKGIJtKnQWsCS41ITKy2zB72PZ8PWY2BXHaIQroP8nimEFoWwb2IZqw+F0CbWvPrEypQk9rreiRcfJ/4neG/oABsxXJX8rrZvmNQYhkMN9WNRxBJoU2HWu5L2NRvGNaL0kNbJZN6eap2czdshsGxf8BFfTzff+SY4v/LHfMQXsw30At79bpfJiS4PPODyD//gMseh5ZXYTfRen7H4H2g32njHIu0ibl7LG9lukVbTKVKQYoNKIg0wts0kF1zQP/FObA77V5QnPjzJ7CGlxFJUn/hzWYfE12gjpb1T4ntrE3/ifXMvgJXSj8V1FWvbkoz2REAjr20UQgphPxTCalLbYgmkEPZLvBObw6G6JIkPTzJ7SCmx5tUn/lzWIfE12sSaV5/43trEn3jf3Jv+2wVDhgyXPdSPRQCjy2sbhZBC2A+FsJrUtlgCKYT9Eu/E5nCoLkniw5PMHlJKrHn1iT+XdUh8jTax5tUnvrc28SfeN/lWlSFDhsse6scigNHltY1CSCHsh0JYTWpbLIEUwn6Jd2JzOFSXJPHhSWYPKSXWvPrEn8s6JL5Gm1jz6hPfW5v4E++bfKvKkCHDZQ/1YxHA6PLaRiGkEPZDIawmtS2WQAphv8Q7sTkcqkuS+PAks4eUEmtefeLPZR0SX6NNrHn1ie+tTfyJ902+VWXIkOGyh/qxCGBn3OXTxaG8en01/Z7J+33ED31EXmL/2kd810f8hY/Ii/f3fcRf+ogHfAZ0mY+3SG2bfMVH5D/B/Kefv5MP+oj855s+r2xPpT5J4rbY5nDYjtvku225jRe8wCXsoTskbvRt4n2OE2naL3qRi3yB5xVXDJYrr8zykpdkeelL++eqq/rn6quzXHNNlt/6rSy//dtZrr02y3XXZXnFK7L4xfcCWCn9WASwMyiEFoWwHoWwnFnVKYVCaEMhrE8sgVtXCJN/u2DIkOGyh/qxCGBnUAgtCmE9CmE5s6pTCoXQhkJYn1gCKYQMGTIcbqgfiwB2BoXQohDWoxCWM6s6pVAIbSiE9YklkELIkCHD4Yb6sQhgZ1AILQphPQphObOqUwqF0IZCWJ9YAimEDBkyHG6oH4sARvcjH5GXnLxO5NvrZbnxRhfpHrJnmBzKu6U3Z/E9PiJ/n/Mak/8U8vf5Oz6CinvcYx7jMu/H7c1ZfODjxb1sEtnXvvKVLnF9feKmef1z/fX9E98BG3ljJa96VZYbbuifeLVxrrxIDg6yxPX1iVcbKr/zOzb3Algp/VgU/+t/ZRnR9CidXcAiV2seO/hdYTflRSWvBPnmO9/WLwuF0KMQ1qIQbl5izatPfAdsYgmkEJYS65ZNXF+feLWhEgph8m8XDBkyXPZQPxZFLIEdC+GsMuXFqXKNTi1mkQvaxy5yHWAmLyp5Jcg33/m2flkohB6FsBaFcPMSa1594jtgE0sghbCUWLds4vr6xKsNFQohQ4brNNSPRRFLYPdCKAdC5iuXLW6RC1IIMay8qOSVIN9859v6ZaEQehTCWhTCzUusefWJ74BNLIEUwlJi3bKJ6+sTrzZUKIQMGa7TUD8WRSyBXQphTdnrt8YqnWqdtzOl47hY5uMpOwS6yotKXgmabfcsIt/WLwuF0KMQ1qIQbl5izatPfAdsYgmkEJYS65ZNXF+feLWhQiFkyHCdhvqxKGIJXJtC2Hp8fJEZtq6JB7Pj0qNaj5sZOwS6OvARB0s7e4uP+KaPOEivnLvWx/s5HzFn07+qcnVX+n2t+WMfTL8581s+YpES+wMfkZfn/MoPpIUwr5oL2PfpxO9NJ69+df8cHLjEVmATe86SEsvYOIkFcqgymSe+A/XvRrzP+rz85f0jX+Ap3/YZ1yePlcT19YlFvT7xauXcC2Cl9GNRxBI4dCGcHKtYsWg18uvMfVTrgtlkfqnSFfIh0NWBjzhY2lkKoUUhtCiEfXNwQCE8nliZbOL6oRLfgfp3I95nfULP6ZCdL4TJv10wZMhw2UP9WBSxBA5dCBdfY4dTLy5o2AUyaTXzsiwZAl0d+IiDpZ2lEFoUQotC2DcHBxTC44mVySauHyrxHah/N+J91if0nA6hEJa3qgwZMlz2UD8WRSyBa1wIK+ftZOkhIl9WehRQ6cBHHCztLIXQohBaFMK+OTigEB5PrEw2cf1Qie9A/bsR77M+oed0CIWwvFVlyJDhsof6sShiCexSCCeFVlY6jsOGPMRetvQU+Zp4MDuWYZwvrQF6O/ARB0s7SyG0KIQWhbBvDg4ohMcTK5NNXD9U4jtQ/27E+6xP6DkdQiEsb1UZMmS47KF+LIpYArsXwoadNEva1wh5eOkhdtKeiouT47hY5u0pWQb0cODjPdpHrGlB+qqPyB+bl5y8PuWvqKkos4ilFZX85zu53kccrOVjc+/w8R7nI+b8Pn96gW9GTStu2J72TywJNnHTPFTindQnXs0mvoqhEstYfTGLr6L+FS0v8T5t4mu0icXVJn7/p038bw02BwdZ5L+GSOJ6m/hcNvE1ll/vvQBWSj8W15WtYevTwaQcAv0c+HgUQodCaK3qsTkKYTmxQgyVeCf1iVezia9iqMSSYBPX28RXUf+Klpd4nzbxNdrEErhjhTD5twuGDBkue6gfi5uADoYtc+DjUQgdCqG1qsfmKITlxAoxVOKd1CdezSa+iqESS4JNXG8TX0X9K1pe4n3axNdoE0sghZAhQ4ZjDfVjcRNQCLFlDnw8CqFDIbRW9dgchbCcWCGGSryT+sSr2cRXMVRiSbCJ623iq6h/RctLvE+b+BptYgmkEDJkyHCsoX4sAhjdgY9HIXQohNaqHpujEJYTK8RQiXdSn3g1m/gqhkosCTZxvU18FfWvaHmJ92kTX6NNLIEUQoYMGY411I9FAKNbpCDlm+D7fURe+b7gI/Ir/42PyF9v7i99xN/5iLwupoVh8hMf8fc+4sBH3Ogj8tr2bR+R/3zzs4v4DR9voW+R/ZyPyH+vvuPjyeY7bm3HSdzo12/6Y4WoT7yaTSwJNq8O37Nan5tu6p/XvKZ/4p0MdVekb+4FsFL6sQhgdPlGlkJoUQgtCqGV/15RCMuJV7OJJZBCSIbOvem/XTBkyHDZQ/1YBDC6fCNLIbQohBaF0Mp/ryiE5cSr2cQSSCEkQyffqjJkyHDZQ/1YBDC6fCNLIbQohBaF0Mp/ryiE5cSr2cQSSCEkQyffqjJkyHDZQ/1YBDC6fCNLIbQohBaF0Mp/ryiE5cSr2cQSSCEkQyffqjJkyHDZQ/1YBDC6vFzlG/c7fUT+vZo/8BEP+Yi8pubVK92aT/7KR+S1LbXv081dPt5C35z5RR+xvPc5f+zy/kPDx1b0zbfpKwrb0yyxQtjceGP/xOeqf95FEu9kqMQCaXNwsKzE57KJ92kT33mb1742y803Z4nVtL6mxldRn/gabeJz2cR3wCaur4+/jXsBrJR+LML4xlE6W6fygYs8BbbG/QtsrymE1fYphFb+2LQ+LfQbSyEsJz5X/fMukngnQyWWE5tY5IZKfC6beJ828Z23iSWQQtgv/jbuTf/tgiFDhsse6sdiMGssjdL8NwqtpnVBaXEPA14qSi6enJopLYjzcQa75v4FttcUwmr7FEIrf2xanxb6jaUQlhOfq/55F0m8k6ESy4lNLHJDJT6XTbxPm/jO28QSSCHsF38b+VaVIUOGyx7qx2IgdaUZ1tSYRR5bacBLRYtcvPTYOB9nsGvuX2B7TSGstk8htPLHpvVpod9YCmE58bnqn3eRxDsZKrGc2MQiN1Tic9nE+7SJ77xNLIEUwn7xt5FvVRkyZLjsoX4sBouUutY13zCamWa+GTbscLammWmGdubhpX44O5CVjdmMkPnZsFlvz84mG82kPRVXzmaaeTvErrl/ge01hbDaPoXQyh+b1qeFfmMphOXE56p/3kUS72SoxHJiE4vcUInPZRPv0ya+8zaxBFII+8XfRr5VZciQ4bKH+rEYlKpLTYcprYnXtDPxbHNgj+UgH9rHylBONWRSlrU+vHQ8G8qB1TqJ3XF/ur3mGzutAx9x49Z9Y+ctPt6jfcScIvolH5EX0fw/NOTv5I99xLd8RP579VUfkf6lxF1ykri1rU/cUg+1vY4FwyY+l02sLkPVmDzxvR0qsRQNlfjtrzaxmg6VeCdDJT5XfeLVbOLPpZx7AayUfiwGs2LTKM1/o1BpWhfI4sqhzM+UFsuwNN86nMnXzL1y5fxM6yR2x/0UQoNCaFEIrfz3ikJYTnwum1gCKYSlxBJIISwl/lzKuTf9twuGDBkue6gfi0Gpq5TmE6VSVDlsfcbSYhnGeWHPzshkabjg/EzrJHbH/RRCg0JoUQit/PeKQlhOfC6bWAIphKXEEkghLCX+XMrJt6oMGTJc9lA/FoNSVynNJ0qlqHLY+oylxTIszSfyh8y9cuX8TOskdsf9FEKDQmhRCK3894pCWE58LptYAimEpcQSSCEsJf5cysm3qgwZMlz2UD8Wg1JXKc1blaUoGX7jqNZjOYjD1vXx1GzYHFvJGnvl0vHsQIYy3zqDXXM/hdCgEFoUQiv/vaIQlhOfyyaWQAphKbEEUghLiT+XcvKtKkOGDJc91I/FoFRXZuXH0hVHtS6QGXuqmWkW2LN2vmammbcLmhm7spU9JcvklBUX2KEss6ews/LN94M+Ii9m+cY9/d7FOQ58RF69DtbysbnbfbyFitn7fUT+08/PphVozn9o+KaPyAvwQ9n30+77qAVK3SJ/R2F7uqzETbPNwUGWuL7+sXlisbG54Yb+iVeziXcy1F298pVZXvGKLNddl+Xaa7O87GVZrrkmy1VXZXnpS7P8+q9nufLKLFdckeXyy7NcemmWSy7JctFFNvcCWCn9WIQhza1Gj/VdH4Lts8BGlkLoLPLYHIXQohD2TSxy9aUurq9/bJ5Yt+qrV554NZt4J0PdVSyBFMJSYglcUSFM/u2CIUOGyx7qxyK6axod7Q79LLCRpRA6izw2RyG0KIR9E4tcfamL6+sfmyfWrfrqlSdezSbeyVB3FUsghbCUWAIphAwZ7t5QPxbRy6wK0gbRzwIbWQqhs8hjcxRCi0LYN7HI1Ze6uL7+sXli3aqvXnni1WzinQx1V7EEUghLiSWQQsiQ4e4N9WMRwOgW2MhSCJ1FHpujEFoUwr6JRa6+1MX19Y/NE+tWffXKE69mE+9kqLuKJZBCWEosgRRChgx3b6gfiwBGR6mzFnks0Ivfm87J4cNZLrwwy/5+lgsuyPLCF2Y5//ws553XP+eem+W5z81y9tlZnvWsLGeemeUZz8hyxhlZTj89y1OfmuUpT8ly2mlZ9vayPPGJWR7/+Cynnprln/2zLL/4i1ke/egsJ5/cP496lM29AFZKPxYBjI5CaC3yWKCX2PqSxBJoE0sghbCUWAIphKXEErh1hTD5twuGAw6BVvqxGNj/6ziOV3uMbUUhtBZ5LNBLbH1JYgm0iSWQQlhKLIEUwlJiCaQQMuw1BFrpxyKA0VEIrUUeC/QSW1+SWAJtYgmkEJYSSyCFsJRYAimEDHsNgVb6sQhgdBRCa5HHAr3E1pcklkCbWAIphKXEEkghLCWWQAohw15DoJV+LAIAsFv83nTyj/9xln/0j7L8/M9nOeGELI94RBZge+nmFMC49G/Sa/4P2Frp6h02nU51CgCwGSiEwErp5hTAuPRv0tMK6OnqoLUm2cmp0Tpp5+OC0nw8NRPn40w/Q10HADA6CiGwUro5BTAu/Zv0tAJ6ujqI3czOxFP5fByWjuOwNBln+hnqOgCA0VEIgZXSzSmAcenfpKcV0NPVga1/caZUouJ88pDkVBTX2JnZvc2YJVXz9lRpsjnVTAIA1gCFEFgp3ZwCGJf+TXpaAT1dHTQtKBlGcT55SHIqimvsw0vHswMZJuvnHgMAAOBhujkFMC79m/S0Anq6OphVIFuK7HB23LCTzbHMJKdmx/Fqll3QaE7JSjtszF1fOQ8AAICf0c0pgHHp36SnFdDT1YGtQ3OrUbKg5pRonY+TcoeWXRPn7QI7lMV2/vhqAAAAzOjmFMC49G/S0wro6erA1qG51ShZUHNKtM7HyeTKMzJfWl+ab5TmAQAAdppuTgGMS/8mPa2Anq4OWltQqTvNnY/D0nEclibtk7ZeTSZb15eOZ0M5AAAAwHG6OQUwLv2b9LQCero6aG1B0pcarZN2Pi4ozcdTM3HezpQebiftqeOrj52N83ayOQYAAMDDdHMKYFz6NwkAAACMRjenAMalf5MAAADAaHRzCmBc+jcJAAAAjEY3pwDGpX+TAAAAwGh0cwpgXPo3CQAAAIxGN6cAxqV/kwAAAMBodHMKYFz6NwkAAACMRjenAMalf5MAAADAaHRzCmBc+jcJAAAAjEY3pwDGpX+TAAAAw3vEIzrkhBP65+d/3uWkk8iaRzenAMal/3Pt3ZHS1etqOp3q1CqsyW0AALAKsfUliTWvPhTCTYtuTgGMS//n2tMK6OnqgukxNfPNpD3VOmm1LogHNeLiONPPUNcBAGADxdaXJNa8+lAINy26OQUwLv2fa08roKer29gW1PU4n7TyBflZERfHmX6Gug4AABsotr4ksebVh0K4adHNKYBx6f9ce1oBPV0dlCpQnG9m4qnSpNW6oPWaU6OZtOJ8zcNr5u2p0mRzqpkEAGArxNaXJNa8+lAINy26OQUwLv2fa08roKerg1KxifPNTDxVmrRaF8Rr2q5V6l1xsvUhcjw7kGGyfu4xsFH2fXKn+nSyL090iw/QS9ieEkLGjG5ON8HdwBbRj0VPK6Cnq4NSvYnzUooayaTVuiA5aB02k1FzSlbaYWPu+sp5YHPsUwixycL2lBAyZrRsbYKf7qFvOul7TTZlCLTSj0VPK6Cnq4NSw4nzeSlqnbRaF8RrToPjq4+Jk82MPtisbJ23C+xQFtv546uBTbJPIcQmC9tTQsiY0bK1Ce4OXWsjhkAr/Vj0tAJ6ujooNZw4n5ei1kmrdUG8ZusyEdfMfbjMl9aX5huleWDt7VMIscnC9pQQMma0bG2Cu0PX2ogh0Eo/Fj2tgJ6ubmNLTtfjfNJqXRAL2PSouMCKk3MfLpOt60vHs6EcAJtmn0KITRa2p4SQMaNlaxPcHbrWRgyBVvqx6GkF9HR1waz/xLbTOh+XlSat1gXNpD3bPGnrQyZtl6p5uJ20p46vPnY2ztvJ5hgAMJawPe2QE0/skBPC92HWR76EE9gidwNYKf2bBABgt8SaV5/Y+pKcEGpefSiE2F53A1gp/ZsEAGC3xJpXn9j6kpwQal59KITYXncDWCn9mwQAYLfEmlef2PqSnBBqXn0ohNhedwNYKf2bBABgt8SaV5/Y+pKcEGpefSiE2F53A1gp/ZsEAAAARqObUwDj0r9JAAAAYDS6OQUwLv2bBAAAAEajm1MA49K/SQAAAGA0ujkFMC79mwQAAABGo5tTAOPSv0kAAABgNLo5BTAu/Zv0pv8zyyaaTqc6tUwjPx0AAMCG0c0pgHHp36QXS2CPQjg9Rk+0kWWVj6rXesE4GWf6Geo6AAAA20k3pwDGpX+TXiyBXQuhbUQ17ahmzSJarx8n40w/Q10HAABgO+nmFMC49G/SiyWwUyGMdaiZmXpxUta3nm0WxHk7aedlTWlSHhKvUzlvT5Umm1PNJAAAwK7QzSmAcenfpBdL4LCFsPV4diDDZL19SM117HxpsvX6cjw7kGGyfu4xAADAztHNKYBx6d+kF0vggIVwqfOitL6ZjJpTstIOG3PXV84DAADsFt2cAhiX/k16sQRuUCGcenFBI07a9cKuifN2gR3KYjt/fDUAAMCu0c0pgHHp36QXS+CmFMLK+dJkvn4S5kvrS/ON0jwAAMBO0M0pgHHp36QXS2CnQjjxhUeObVkqFafSmpr1drJ1vhEnW59L5u1k6/rS8WwoBwAAALtIN6cAxqV/k14sgV0L4eRYF5Lm00zKKZlpPSWTzbEM7eJmXtaXJluvI8vspD11fPWxs3HeTjbHAAAAO0c3pwDGpX+TY6EIAQAAYKKbUwDj0r/JsVAIAQAAMNHNKYBx6d/kWCiEAAAAmOjmFMC49G8SAAAAGI1uTgGMS/8mAQAAgNHo5hTAuPRvEgAAABiNbk4BjEv/JgEAAIDR6OYUwLj0bxIAAAAYjW5OAYxL/yYBAACA0ejmFMC49G8SAAAAGI1uTgGMS/8mvenXvpZEV2+p0v8vE0vzAAAAqKWbUwDj0r9JL5bAroVwaui5OvLA3tdp2Ftq6CKjdLY0DwAAgFq6OQUwLv2b9GIJ7FQIpTL1a1D9HlWj8sqlZaV5AAAA1NLNKYBx6d+kF0vgIoXQav5pLpZGO2lWHZ+Ji2XSnmrmo3i2eZQ9ZSdlvnVNMwkAAIA5dHMKYFz6N+nFEjhIIbTFKTmWgzg/93g2bI5F6coyLF28NNkcAwAAYA7dnAKrpr+juy2WwE6FcHKsIElNkspk25Sdb50sLZ47HyWnJhUXjAetQwAAABTpZhxYNf0d3W2xBHYthJZtUEIWWDJZWjx3Poqnjt/QUc2krIkH4vhqAAAAJHQzDqya/o7utlgChyqE/szDWudlsnSRufNRvnLuBeMBAAAAutHNOLBq+ju622IJ7FQIkyplT7XOx4M4XzqeHbQOrWRlcvH4RHbSzgMAAGAO3YwDq6a/o7stlsBOhXByrCxJZaqZL820npLJ5jgOrXjKXq0520w2p5p5exwXAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADOp7KV0NAAAAANgaWgE9XZ2aTqc6Vaf3AwEAAAAA/WkF9HR1qnev6/1AAAAAAEB/WgE9XV02NZJJe1YWyCkAAAAAwHJpBfR0daq17LUelw4AAAAAAOPRCujp6lQshK3D5AAAAAAAMB6tgJ6uTsUGKOSUHTbHAAAAAICRaAX0dHVKel2p5jXz8QAAAAAAMB6tgJ6uDpJ/6Cv9M2ByAAAAAAAYj1ZAT1cHUvliCZRJe7YZyhoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIBddW9KVwMAAAAAtoZWQE9XAwAAAAC2hlZAT1cDAAAAALaGVkBPV6em0+ns/zs7aI6bYeUaAAAAAMAYtAJ6ujrV2v3kOK6xp5p5AAAAAMDSaQX0dHVKGl1rwatZAwAAAAAYg1ZAT1enYrub/QOgnacQAgAAAMC60Aro6epU0u6aUxRCAAAAAFgXWgE9XR1U/utfUghLpwAAAAAAy6UV0NPVQWvrszO28s1mzPmHZ2QNAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADArro7pauHMJ1OdQoAAAAAMD6tgJ6uHgKFEAAAAADWglZAT1cPgUIIAAAAAGtBK6Cnq1Ozpjc9qplpyLJkgZ23kwAAAACAIWkF9HR1SiqcHcpx62TpeHYAAAAAABiYVkBPV6ekvJWG8SCfBwAAAAAshVZAT1enYsETsqw5yOcBAAAAAEuhFdDT1alSwROl4leaBwAAAAAshVZAT1cHtrzFgtd61h7UHM8OAAAAAAAD0wro6eqgtfLZmYadzBfYeTsJAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACw9aZpcMx02v52lOYBAAAAYO0ldSY5dczU09NrTO58RhcZpbOleQAAAABYe7M60/pvgxVNR+rQJrajynsuLSvNAwAAAMDaW1ohbP7ZLa5JJu18XGMP7OL4WDsp8yKebX2gnZT51jXNJAAAAACsq1lzmYY0p1LSfJqhLUVyPDuwxzWL7dCukWHrGlkv5FRpWLpgabI5BgAAAIB1Nast05DmVGrWfBp23qxyrcnOt06WFs+dTyZb18wkpyYVTxoPWocAAAAAsH5mtWUa0pxK2dojxyKesjPNsR12nZdJoSuOiadaHyjL4rw8qpkHAAAAgHU1qy3TkOZUSmpPM6ypQ6XFvefnTrbKrzb3SeMBAAAAAGyIpMUkp45JapI91dqaWhfL8ewgmS+dspN2PopXs8etF5TjOGnnAQAAAGBdTdPME2uPFCSpSXa+dbI0PztuJu2a2UzyWJkX8ax9VHO2mWxONfP2OC4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACoNp1Mk+hqAAAAAMDWSFpfcqoxnc5fM4jRnggAAAAAdsWs9bX+2yCFEAAAAAC22VCFcGrYoV1pNfNyyk7KqZn4qGYGAAAAANDBgIUwTtpjW966Hs+GzbEM5RQAAAAAoMqYhbCZXGS+dQgAAAAA6GxDC+FsZkbmAQAAAABVNrcQNpJTAAAAAICipPUlpxqt/a31eHpUp+PZwdyhnAIAAAAAVIn/Nij/Tphr7W+tx7Oy12gWyCk7aZYcX5PMAAAAAADWEc0NAAAAAHYUhRAAAAAAdhSFEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAhd100veS6OqF8f83QgAAAABYF0nrS041pp6eDmrW1JOrDXtxAAAAANhys9bX+m+DlYUwGUZzF3Qy7NUAAAAAYLcsrxA2/2wok/kCO9862cy3ziTrmwVxvjQJAAAAANtsSYXQlis5bp0sHctB/fzc49lQDuQYAAAAALbZ4oXQsvNmVUv1mrsgUVo81DwAAAAA7ITFC2HpWMia5iCfb/iLtS/uPT87tlcGAAAAgO03YCG0w1KzKi0ozbdOlhb3np87CQAAAABbKGl9yalGqWJNj2qdjwuSYzkoLZDh3AvK0M7LGgAAAADYWvHfBuXfCXOxPkkTs33Mni0tsPOlyeaUrLQPaU7JZHMsw7gYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgdL/6X/9vEl29RabTqU4BAAAAwE6JJbBHIZweY2fM+YdnLDk70zrfOmnNXdBq7qPmLgAAAACAzRZLYNdCaItTcxzblMzEBbPJuKx1pTV3Qau5j5q7AAAAAAA2WyyBnQphqTXF+dj07LCZjMvszGxoJ+NMaVLm7ak4GWdKkwAAAACwqWIJXG0hbP6/rcPS8ewgH3Z9eGm+dQgAAAAAmyeWwOUVQkvOzszmm7Otw0ZpXpSWlR5VWi/yswAAAACwAWIJXF4hbD22bBmLxWw2acmCRs0yO6xZP5uJywAAAABgU8USOEIhjEOZtI0rHoj8yqWH955vHQIAAADA5oklsFMhnPhqVGpTcSYumDs5Pap1vpmUoX1Icjw7SOZlaJcBAAAAwKaKJbBrIZwcK0ixMtl5e7ZZM3dGJuWaMtk60zrfnE3WVy4DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYzvR//J8kuhoAAAAAsDViCaQQAgAAAMBOiCWwXyGcTqdyAAAAAABYa7EELlIIaYMAAAAAsDFiCexaCKdtdBEAAAAAYN3EEti1EE7S//eisSLGNQAAAACAFYglcMBCKD1QmiEAAAAAYJViCexUCJuaZ+kiAAAAAMAaiiWwUyGcmZVAqiAAAAAAbJJYArsWwqYHUggBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAW84M//e9JdDUAAAAAYGvEEjhsIZwadtIsUflZAAAAAMAwYgnsVwibFpcUv9Y1AAAAAIDViCVwkUJYaoAy2WhmmvlmKPPNZHPKivNmLQAAAACgTSyBXQuh6WXHNaf82ofJvH3IbFg/L8ezAzkGAAAAALSIJbBrIZyEf9OzZoXN1rbZpFlSHC44DwAAAADIxBI4bCG0SstKw67zs+MZcx4AAAAA0CaWwE6FsClgli46pjkla0rDrvNzJwEAAAAAx8US2KkQzszaV+xgpeZWmpdhMl86nh3IMQAAAACgRSyBXQthax9rzAqbrW12shk2p+ywND87tuJ8MwMAAAAA2FrUPwAAAADYIU0J5N8DAQAAAGDn8P86FAAAAAAAAAAAAACA/9/eHd26bQRRAFWFKSRIHwnSh9NI2nAvDGw669HM7pJ8pOyEOgf62L0zpPx7IQMPAAAAAAAAAAAAAAAAAAAAAAAAAHg/f//51+STtwEAALiNWgIvLIT1r8bHpP1l+boGAADAy9US+LFC2EpdqnztnJI0qpsAAAC8Vi2BZwrhZs0bFUIAAAB+tFoCjxbCb//p81kbPe8qhAAAAP8ZtQQeLYSPcc2rrS8moT/mNQAAAF6ulsAfVgijUQ4AAMCr1BJ4qBDGX/maOA27/WQ1ygEAAHiVWgIPFcLVWudqqav9sF3Tcn0WAACA16ol8GghHHW8FkajUcwBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAN7Vp9/+mHzyNgAAALdRS+DlhXAJYhhWnpJ46D4LAADABWoJ/FghrHVufq0Fr45GzwIAAHCBWgLPFML9Fa6Oag+c7AAAAHBWLYFHC+HS00bPu9/VUX1qsgMAAMBZtQQeLYSPcYWL182uWEeTHQAAAM6qJfBFhTAle0aTHQAAAM6qJfBQIfzyk18Rp2H3KdkzmuwAAABwVi2Bhwrhau1p3baWwlj2UnWsPXD0LAAAABeoJfBoIRz1t2Yte7Hy1TyO2nm0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABwU7//8uvkk7cvsixLjp5tLgAAAHBWLYEXFsLlWczDVsfmAgAAAGfVEvixQtgq3KT4dXe6NhcAAAA4q5bAM4Vw1ADTNZXGphvGHAAAgMvUEni0EKbytmqjtFkPh84AAABcppbAo4Xw0Wt67RrFPB125gAAAFymlsBrC2H3Wg87cwAAAC5TS+ChQvjlh78iTsNup+9tLnSvAAAAXKCWwEOFcLUWtlrbRr0uHg6dAQAAuEwtgUcLYWxuz5NvXa6JeXenG8YcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAODWPi+fJ5+8DQAAwG1MWt9k1CzPuuHq+blvazn6N8wPD96cHqz5aKeGKYlXAACAe1pbX/e3wZ2FcP816U7XsDt6lLxd9+ST8+hxAACAO/uJhfBRFrpFLvrwfl1Io7hQlwEAAG5IIVQIAQCAN3W+EEZ1mpIkLbRreu0o//7k8yiG6dDUUT0AAADc2flC2D2Pkqpbw0YP7tl59N5Zl7uj9VyXAQAAbujCQrh57ZoUs2rn++s762Z3pBACAABvZNL6JqNm3tB2Nqvlq5TEazNa25PvOa/X0bcDAADcSv1tMP1OOFe706RrjdQOtiZRy+NaTOpynLZrWljDdE0JAAAAAAAAAAAAADu1/67Z5A0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgwzL9AAAAcFuT1jcZNfmPzW/9ufnNhYlDX/TY8V2bCwAAAHe2VqLub4N72tLRTnV0P0rPnnnV6vwbAAAA/sdeVAjXPP2a164xqWtxNEnitb0hhfGQFtq1JQAAAO+ldb/0aaO5UZtKRSvWsBau18koXmsSHxyda5jyFgIAALydtRIt5dNGc2vXilqe1uZ5uqa8hVHMw1bnJZsLAAAA76h1v/Rpo7lRp9rZwUbX7mu74aPk9SWbCwAAAO+odb/0aaO5Uafa2cHq42tS81H4KHn9rs0FAACAdzSpRJNRM+pUOztYfXz5KoWrSR7fX79r9KWjFwIAALyFZfrZtBawqOVprR0ma5PwMc4fz/+MGKZDzdMjAAAA/EwaGgAAwDvSBgEAAN6O/70JAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABM/QNNTQk7sdg0TgAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"job_id":"68b8504446b83fb2480c50bd","environment_id":160,"environment_description":"Windows 10 64 bit","size":3584,"type":"PE32 executable for MS Windows 4.00 (DLL), Intel i386 Mono/.Net assembly, 3 sections","type_short":["pedll","executable"],"type_short_id":"dll","target_url":null,"state":"SUCCESS","error_type":null,"error_origin":null,"submit_name":"x.exe","md5":"aa5634ff5927a0387a2680a8b9861b20","sha1":"2d6a94770b7dc25280d07a2fb66e5230e16710fd","sha256":"292ea9dbc5a1d15b769edb5df1602418931122455223081064ad7ea4e8ab6821","sha512":"36cce84ebb522d9dcacfd3718b37b1ca6f0f01f94bfb3460c4e2a7f9bde8bf9f26188018e95e59aeec5533b5b6398c8434e6afc500858109e9f473992b022dd0","ssdeep":"24:etGSLM2WR2/VTZ1Rqa1IetkZfs8u5KLXI+ZHUC2WI+ycuZhNjxakSo2PNnq:6R3VpVCRJshaXII0G1ulFa3Zq","imphash":"dae02f32a21e03ce65412f6e56942daa","entrypoint":"0x1000241e","entrypoint_section":".text","image_base":"0x10000000","subsystem":"Windows Cui","image_file_characteristics":["EXECUTABLE_IMAGE","32BIT_MACHINE","DLL"],"dll_characteristics":["DYNAMIC_BASE","NX_COMPAT","NO_SEH","TERMINAL_SERVER_AWARE"],"major_os_version":"4","minor_os_version":"0","av_detect":0,"vx_family":null,"url_analysis":false,"analysis_start_time":"2025-09-03T14:27:18+00:00","threat_score":60,"interesting":false,"threat_level":2,"verdict":"malicious","certificates":[],"is_certificates_valid":false,"certificates_validation_message":"No signature was present in the subject. (0x800b0100)","domains":[],"compromised_hosts":[],"hosts":[],"total_network_connections":0,"total_processes":2,"total_signatures":242,"extracted_files":[],"file_metadata":{"file_compositions":[],"imported_objects":[],"file_analysis":[],"total_file_compositions_imports":null},"processes":[{"uid":"00000000-00000576","parentuid":null,"name":"","normalized_path":null,"command_line":null,"sha256":null,"av_label":null,"av_matched":null,"av_total":null,"pid":"576","icon":null,"process_flags":[]},{"uid":"00000000-00007376","parentuid":null,"name":"regsvr32.exe","normalized_path":"%WINDIR%\\SysWOW64\\regsvr32.exe","command_line":"/s \"C:\\x.exe.dll\"","sha256":"c960830805837d103f3a0727f94b62cdc7d763d66c1598f86aabf9b705602344","av_label":null,"av_matched":null,"av_total":null,"pid":"7376","icon":"$25","process_flags":[{"name":"Extracted Streams","data":null}]}],"mitre_attcks":[{"tactic":"Reconnaissance","technique":"Firmware","attck_id":"T1592.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1592/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to gather system firmware table (API string)"],"parent":{"technique":"Gather Victim Host Information","attck_id":"T1592","attck_id_wiki":"https://attack.mitre.org/techniques/T1592"}},{"tactic":"Execution","technique":"Native API","attck_id":"T1106","attck_id_wiki":"https://attack.mitre.org/techniques/T1106","malicious_identifiers_count":1,"malicious_identifiers":["Contains native function calls"],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":15,"informative_identifiers":["Contains ability to create/open files (API string)","Contains ability to create a new process (API string)","Contains ability to set/get the last-error code for a calling thread (API string)","Contains ability to load modules (API string)","Contains ability to execute an application (API string)","Contains ability to find and load resources of specific modules (API string)","Contains ability to execute Windows APIs","Able to use GrayString API for text rendering","Contains ability to retrieve address of exported function from a DLL (API string)","Contains ability to retrieve/modify process thread (API string)","Contains ability to retrieve user-agents (API string)","Contains ability to retrieve the fully qualified path of module (API string)","Contains ability to load modules (API string)","Contains ability to dynamically load libraries","Calls an API typically used to retrieve function addresses"],"parent":null},{"tactic":"Execution","technique":"Windows Command Shell","attck_id":"T1059.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1059/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Able to retrieve command line parameters of the running process","Contains ability to retrieve the command-line string for the current process (API string)"],"parent":{"technique":"Command and Scripting Interpreter","attck_id":"T1059","attck_id_wiki":"https://attack.mitre.org/techniques/T1059"}},{"tactic":"Execution","technique":"Windows Management Instrumentation","attck_id":"T1047","attck_id_wiki":"https://attack.mitre.org/techniques/T1047","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":2,"suspicious_identifiers":["Found a reference to a WMI query string known to be used for VM detection","Contains references to WMI/WMIC"],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to execute a WMI query"],"parent":null},{"tactic":"Execution","technique":"Service Execution","attck_id":"T1569.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1569/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to open a service (API string)"],"parent":{"technique":"System Services","attck_id":"T1569","attck_id_wiki":"https://attack.mitre.org/techniques/T1569"}},{"tactic":"Execution","technique":"Inter-Process Communication","attck_id":"T1559","attck_id_wiki":"https://attack.mitre.org/techniques/T1559","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to create/connect to a named pipe (API string)"],"parent":null},{"tactic":"Execution","technique":"Shared Modules","attck_id":"T1129","attck_id_wiki":"https://attack.mitre.org/techniques/T1129","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":4,"informative_identifiers":["Contains ability to access the loader directly (API string)","Loads modules at runtime","Calls an API typically used to load libraries","Loads the RPC (Remote Procedure Call) module DLL"],"parent":null},{"tactic":"Persistence","technique":"Windows Service","attck_id":"T1543.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1543/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":5,"informative_identifiers":["Contains ability to access device drivers","Contains ability to modify system service (API string)","Contains ability to create a service (API string)","Contains ability to create/control drivers (API string)","Contains ability to start a service (API string)"],"parent":{"technique":"Create or Modify System Process","attck_id":"T1543","attck_id_wiki":"https://attack.mitre.org/techniques/T1543"}},{"tactic":"Persistence","technique":"Modify Registry","attck_id":"T1112","attck_id_wiki":"https://attack.mitre.org/techniques/T1112","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":4,"informative_identifiers":["Able to create/load registry keys (API string)","Contains ability to disable/close registry key (API string)","Contains ability to modify registry key/value (API string)","Able to delete registry key/value (API string)"],"parent":null},{"tactic":"Persistence","technique":"Account Manipulation","attck_id":"T1098","attck_id_wiki":"https://attack.mitre.org/techniques/T1098","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to modify the user configuration/privilege (API string)"],"parent":null},{"tactic":"Persistence","technique":"Local Account","attck_id":"T1136.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1136/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to create a new user account (API string)"],"parent":{"technique":"Create Account","attck_id":"T1136","attck_id_wiki":"https://attack.mitre.org/techniques/T1136"}},{"tactic":"Persistence","technique":"Port Monitors","attck_id":"T1547.010","attck_id_wiki":"https://attack.mitre.org/techniques/T1547/010","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to setup port monitor (API string)"],"parent":{"technique":"Boot or Logon Autostart Execution","attck_id":"T1547","attck_id_wiki":"https://attack.mitre.org/techniques/T1547"}},{"tactic":"Persistence","technique":"Office Application Startup","attck_id":"T1137","attck_id_wiki":"https://attack.mitre.org/techniques/T1137","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains reference to messaging system library (API string)"],"parent":null},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attck_id":"T1547","attck_id_wiki":"https://attack.mitre.org/techniques/T1547","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Found registry location strings which can modify auto-execute functionality"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Persistence","technique":"Print Processors","attck_id":"T1547.012","attck_id_wiki":"https://attack.mitre.org/techniques/T1547/012","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to load malicious DLLs at startup using print spooler service (API string)"],"parent":{"technique":"Boot or Logon Autostart Execution","attck_id":"T1547","attck_id_wiki":"https://attack.mitre.org/techniques/T1547"}},{"tactic":"Persistence","technique":"Path Interception by PATH Environment Variable","attck_id":"T1574.007","attck_id_wiki":"https://attack.mitre.org/techniques/T1574/007","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["References PATH environment registry keys"],"parent":{"technique":"Hijack Execution Flow","attck_id":"T1574","attck_id_wiki":"https://attack.mitre.org/techniques/T1574"}},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attck_id":"T1547.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1547/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["References user shell folders registry key string"],"parent":{"technique":"Boot or Logon Autostart Execution","attck_id":"T1547","attck_id_wiki":"https://attack.mitre.org/techniques/T1547"}},{"tactic":"Persistence","technique":"DLL","attck_id":"T1574.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1574/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Potential hijacking of DLL execution flow detected"],"parent":{"technique":"Hijack Execution Flow","attck_id":"T1574","attck_id_wiki":"https://attack.mitre.org/techniques/T1574"}},{"tactic":"Privilege Escalation","technique":"Windows Service","attck_id":"T1543.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1543/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":5,"informative_identifiers":["Contains ability to access device drivers","Contains ability to modify system service (API string)","Contains ability to create a service (API string)","Contains ability to create/control drivers (API string)","Contains ability to start a service (API string)"],"parent":{"technique":"Create or Modify System Process","attck_id":"T1543","attck_id_wiki":"https://attack.mitre.org/techniques/T1543"}},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attck_id":"T1134.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1134/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to obtains specified information about the security of a file or directory (API string)","Contains ability to impersonate access tokens (API string)"],"parent":{"technique":"Access Token Manipulation","attck_id":"T1134","attck_id_wiki":"https://attack.mitre.org/techniques/T1134"}},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attck_id":"T1055.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to load/free library (API string)","Contains ability to create a remote thread (API string)"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attck_id":"T1055.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Privilege Escalation","technique":"ListPlanting","attck_id":"T1055.015","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/015","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to visualize and control listed components (API string)"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Privilege Escalation","technique":"Account Manipulation","attck_id":"T1098","attck_id_wiki":"https://attack.mitre.org/techniques/T1098","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to modify the user configuration/privilege (API string)"],"parent":null},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attck_id":"T1134.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1134/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to create process with token (API string)"],"parent":{"technique":"Access Token Manipulation","attck_id":"T1134","attck_id_wiki":"https://attack.mitre.org/techniques/T1134"}},{"tactic":"Privilege Escalation","technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to inject code into another process (API string)"],"parent":null},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attck_id":"T1055.004","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/004","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attck_id":"T1134","attck_id_wiki":"https://attack.mitre.org/techniques/T1134","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to modify access token privileges (API string)","Contains ability to retrieve token privileges information (API string)"],"parent":null},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attck_id":"T1055.012","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/012","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to unmap view of a section from a process (API string)"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Privilege Escalation","technique":"Port Monitors","attck_id":"T1547.010","attck_id_wiki":"https://attack.mitre.org/techniques/T1547/010","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to setup port monitor (API string)"],"parent":{"technique":"Boot or Logon Autostart Execution","attck_id":"T1547","attck_id_wiki":"https://attack.mitre.org/techniques/T1547"}},{"tactic":"Privilege Escalation","technique":"Boot or Logon Autostart Execution","attck_id":"T1547","attck_id_wiki":"https://attack.mitre.org/techniques/T1547","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Found registry location strings which can modify auto-execute functionality"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attck_id":"T1055.011","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/011","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Found a string that may be used as part of an injection method"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Privilege Escalation","technique":"Print Processors","attck_id":"T1547.012","attck_id_wiki":"https://attack.mitre.org/techniques/T1547/012","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to load malicious DLLs at startup using print spooler service (API string)"],"parent":{"technique":"Boot or Logon Autostart Execution","attck_id":"T1547","attck_id_wiki":"https://attack.mitre.org/techniques/T1547"}},{"tactic":"Privilege Escalation","technique":"Path Interception by PATH Environment Variable","attck_id":"T1574.007","attck_id_wiki":"https://attack.mitre.org/techniques/T1574/007","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["References PATH environment registry keys"],"parent":{"technique":"Hijack Execution Flow","attck_id":"T1574","attck_id_wiki":"https://attack.mitre.org/techniques/T1574"}},{"tactic":"Privilege Escalation","technique":"Registry Run Keys / Startup Folder","attck_id":"T1547.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1547/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["References user shell folders registry key string"],"parent":{"technique":"Boot or Logon Autostart Execution","attck_id":"T1547","attck_id_wiki":"https://attack.mitre.org/techniques/T1547"}},{"tactic":"Privilege Escalation","technique":"DLL","attck_id":"T1574.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1574/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Potential hijacking of DLL execution flow detected"],"parent":{"technique":"Hijack Execution Flow","attck_id":"T1574","attck_id_wiki":"https://attack.mitre.org/techniques/T1574"}},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attck_id":"T1027","attck_id_wiki":"https://attack.mitre.org/techniques/T1027","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["YARA signature match - MD5 algorithm"],"informative_identifiers_count":9,"informative_identifiers":["Contains CRYPTO related strings","Contains ability to use Cryptographic classes","Able to utilize the Windows bcrypt cryptographic API","Contains references to RC4 cryptographic API (string)","Contains ability to encrypt/encode message (API string)","Loads the Bcrypt module DLL","Matched Compiler/Packer signature (DIE)","YARA signature match - RC4 Encryption","Shows ability to obfuscate file or information"],"parent":null},{"tactic":"Defense Evasion","technique":"Token Impersonation/Theft","attck_id":"T1134.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1134/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to obtains specified information about the security of a file or directory (API string)","Contains ability to impersonate access tokens (API string)"],"parent":{"technique":"Access Token Manipulation","attck_id":"T1134","attck_id_wiki":"https://attack.mitre.org/techniques/T1134"}},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attck_id":"T1222","attck_id_wiki":"https://attack.mitre.org/techniques/T1222","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to modify file attributes (API string)"],"parent":null},{"tactic":"Defense Evasion","technique":"Dynamic-link Library Injection","attck_id":"T1055.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to load/free library (API string)","Contains ability to create a remote thread (API string)"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Defense Evasion","technique":"Timestomp","attck_id":"T1070.006","attck_id_wiki":"https://attack.mitre.org/techniques/T1070/006","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Contains ability to retrieve file time (API string)","Contains ability to set file time (API string)","Contains ability to query local/system time as file time"],"parent":{"technique":"Indicator Removal","attck_id":"T1070","attck_id_wiki":"https://attack.mitre.org/techniques/T1070"}},{"tactic":"Defense Evasion","technique":"Modify Registry","attck_id":"T1112","attck_id_wiki":"https://attack.mitre.org/techniques/T1112","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":4,"informative_identifiers":["Able to create/load registry keys (API string)","Contains ability to disable/close registry key (API string)","Contains ability to modify registry key/value (API string)","Able to delete registry key/value (API string)"],"parent":null},{"tactic":"Defense Evasion","technique":"Thread Execution Hijacking","attck_id":"T1055.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attck_id":"T1497.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1497/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Contains ability to delay execution by waiting for signal/timeout (API string)","Contains ability to retrieve the time elapsed since the system was started (API string)","Contains ability to delay the execution of current thread"],"parent":{"technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497"}},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attck_id":"T1497.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1497/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Able to identify virtual environment by using user activity (API string)","Able to identify virtual environment using user register activity"],"parent":{"technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497"}},{"tactic":"Defense Evasion","technique":"System Checks","attck_id":"T1497.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1497/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Able to identify virtual/sandbox environment","Able to identify virtual environment by using API string"],"parent":{"technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497"}},{"tactic":"Defense Evasion","technique":"ListPlanting","attck_id":"T1055.015","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/015","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to visualize and control listed components (API string)"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Able to identify sandbox environment running process","Contains ability to detect presence of virtual environment (API string)","Contains ability to detect virtual environment (API)"],"parent":null},{"tactic":"Defense Evasion","technique":"File Deletion","attck_id":"T1070.004","attck_id_wiki":"https://attack.mitre.org/techniques/T1070/004","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to delete files/directories (API string)"],"parent":{"technique":"Indicator Removal","attck_id":"T1070","attck_id_wiki":"https://attack.mitre.org/techniques/T1070"}},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attck_id":"T1562.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1562/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains strings related to AMSI (Anti Malware Scan Interface)","Contains ability to modify process attributes (API string)"],"parent":{"technique":"Impair Defenses","attck_id":"T1562","attck_id_wiki":"https://attack.mitre.org/techniques/T1562"}},{"tactic":"Defense Evasion","technique":"Create Process with Token","attck_id":"T1134.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1134/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to create process with token (API string)"],"parent":{"technique":"Access Token Manipulation","attck_id":"T1134","attck_id_wiki":"https://attack.mitre.org/techniques/T1134"}},{"tactic":"Defense Evasion","technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to inject code into another process (API string)"],"parent":null},{"tactic":"Defense Evasion","technique":"Clear Windows Event Logs","attck_id":"T1070.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1070/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to remove the event logs"],"parent":{"technique":"Indicator Removal","attck_id":"T1070","attck_id_wiki":"https://attack.mitre.org/techniques/T1070"}},{"tactic":"Defense Evasion","technique":"Asynchronous Procedure Call","attck_id":"T1055.004","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/004","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attck_id":"T1140","attck_id_wiki":"https://attack.mitre.org/techniques/T1140","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to perform decryption (API string)","Shows ability to deobfuscate/decode files or information"],"parent":null},{"tactic":"Defense Evasion","technique":"Access Token Manipulation","attck_id":"T1134","attck_id_wiki":"https://attack.mitre.org/techniques/T1134","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to modify access token privileges (API string)","Contains ability to retrieve token privileges information (API string)"],"parent":null},{"tactic":"Defense Evasion","technique":"Process Hollowing","attck_id":"T1055.012","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/012","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to unmap view of a section from a process (API string)"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attck_id":"T1480","attck_id_wiki":"https://attack.mitre.org/techniques/T1480","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to retrieve information set for devices (API string)","Shows ability to use execution guardrails"],"parent":null},{"tactic":"Defense Evasion","technique":"Hidden Window","attck_id":"T1564.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1564/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to show a graphical window (API string)","Contains ability to pass information to a window procedure (API string)"],"parent":{"technique":"Hide Artifacts","attck_id":"T1564","attck_id_wiki":"https://attack.mitre.org/techniques/T1564"}},{"tactic":"Defense Evasion","technique":"Extra Window Memory Injection","attck_id":"T1055.011","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/011","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Found a string that may be used as part of an injection method"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attck_id":"T1564","attck_id_wiki":"https://attack.mitre.org/techniques/T1564","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Found virtual disk drive like strings"],"parent":null},{"tactic":"Defense Evasion","technique":"Software Packing","attck_id":"T1027.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1027/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Matched Compiler/Packer signature"],"parent":{"technique":"Obfuscated Files or Information","attck_id":"T1027","attck_id_wiki":"https://attack.mitre.org/techniques/T1027"}},{"tactic":"Defense Evasion","technique":"Indicator Removal","attck_id":"T1070","attck_id_wiki":"https://attack.mitre.org/techniques/T1070","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to modify file system redirection (API string)"],"parent":null},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attck_id":"T1027.013","attck_id_wiki":"https://attack.mitre.org/techniques/T1027/013","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["YARA signature match - Medium entropy File"],"parent":{"technique":"Obfuscated Files or Information","attck_id":"T1027","attck_id_wiki":"https://attack.mitre.org/techniques/T1027"}},{"tactic":"Defense Evasion","technique":"Path Interception by PATH Environment Variable","attck_id":"T1574.007","attck_id_wiki":"https://attack.mitre.org/techniques/T1574/007","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["References PATH environment registry keys"],"parent":{"technique":"Hijack Execution Flow","attck_id":"T1574","attck_id_wiki":"https://attack.mitre.org/techniques/T1574"}},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attck_id":"T1006","attck_id_wiki":"https://attack.mitre.org/techniques/T1006","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to enumerate volumes (API string)"],"parent":null},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attck_id":"T1622","attck_id_wiki":"https://attack.mitre.org/techniques/T1622","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to register a top-level exception handler (often used as anti-debugging trick)"],"parent":null},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attck_id":"T1027.005","attck_id_wiki":"https://attack.mitre.org/techniques/T1027/005","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains XOR operation loops [Stream disassembly]"],"parent":{"technique":"Obfuscated Files or Information","attck_id":"T1027","attck_id_wiki":"https://attack.mitre.org/techniques/T1027"}},{"tactic":"Defense Evasion","technique":"Regsvr32","attck_id":"T1218.010","attck_id_wiki":"https://attack.mitre.org/techniques/T1218/010","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Executes a DLL using Regsvr32 process"],"parent":{"technique":"System Binary Proxy Execution","attck_id":"T1218","attck_id_wiki":"https://attack.mitre.org/techniques/T1218"}},{"tactic":"Defense Evasion","technique":"DLL","attck_id":"T1574.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1574/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Potential hijacking of DLL execution flow detected"],"parent":{"technique":"Hijack Execution Flow","attck_id":"T1574","attck_id_wiki":"https://attack.mitre.org/techniques/T1574"}},{"tactic":"Credential Access","technique":"Windows Credential Manager","attck_id":"T1555.004","attck_id_wiki":"https://attack.mitre.org/techniques/T1555/004","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to to enumerates the credentials (API string)"],"parent":{"technique":"Credentials from Password Stores","attck_id":"T1555","attck_id_wiki":"https://attack.mitre.org/techniques/T1555"}},{"tactic":"Credential Access","technique":"Keylogging","attck_id":"T1056.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1056/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to hook/unhook windows functions (API string)","Able to retrieve information about pressed keystrokes (API string)"],"parent":{"technique":"Input Capture","attck_id":"T1056","attck_id_wiki":"https://attack.mitre.org/techniques/T1056"}},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attck_id":"T1555","attck_id_wiki":"https://attack.mitre.org/techniques/T1555","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains string like password/secret"],"parent":null},{"tactic":"Credential Access","technique":"OS Credential Dumping","attck_id":"T1003","attck_id_wiki":"https://attack.mitre.org/techniques/T1003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"],"parent":null},{"tactic":"Discovery","technique":"File and Directory Discovery","attck_id":"T1083","attck_id_wiki":"https://attack.mitre.org/techniques/T1083","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":8,"informative_identifiers":["Contains ability to retrieve file and directory information (API string)","Contains ability to read files (API string)","Able to determine the valid logical drives on the computer","Able to rename or move file/directory (API string)","Contains ability to enumerate files on disk (API string)","Contains ability to retrieve path in which Windows is installed (API string)","Tries to access non-existent files (executable)","Touches files"],"parent":null},{"tactic":"Discovery","technique":"Query Registry","attck_id":"T1012","attck_id_wiki":"https://attack.mitre.org/techniques/T1012","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":6,"informative_identifiers":["Able to query registry keys (API string)","Contains registry location strings","Found registry location strings in memory","Found registry key string for installed applications","Opens registry keys","Queries registry keys"],"parent":null},{"tactic":"Discovery","technique":"Process Discovery","attck_id":"T1057","attck_id_wiki":"https://attack.mitre.org/techniques/T1057","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":11,"informative_identifiers":["Contains ability to determine if process is running under WOW64 (API string)","Contains ability to enumerate process and/or its information (API string)","Able to enumerate system processes using native API","Contains ability to retrieve/open a process (API string)","Able to list processes on remote desktop session host","Contains ability to retrieve process ID (API string)","Contains ability to open handle to a named event object (API string)","Calls an API typically used for taking snapshot of the specified processes","Queries basic information of the specified process","Process launched with changed environment","Contains ability to retrieve/open a process"],"parent":null},{"tactic":"Discovery","technique":"System Information Discovery","attck_id":"T1082","attck_id_wiki":"https://attack.mitre.org/techniques/T1082","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":3,"suspicious_identifiers":["Contains ability to retrieve a module handle","Contains ability to retrieve information about the current system"],"informative_identifiers_count":22,"informative_identifiers":["References to WMI query strings used for information discovery","Contains ability to retrieve a module handle (API string)","Contains ability to retrieve the OS information (API string)","Able to gather system information (.NET)","Contains ability to find logical drives of the machine (API string)","Contains reference to mutex-related activity (API string)","Able to retrieve information about the current system (API string)","Contains ability to retrieve the host name of a computer (API string)","Able to discover operating system information (API string)","Contains ability to retrieve volume information (API string)","Able to retrieve geographical location information","Able to retrieve the local machine's name","Contains ability to determine disk drive type (API string)","Contains ability to retrieve the NetBIOS name of the local computer (API string)","Contains ability to retrieve the specified system metric or system configuration setting (API string)","Able to query volume/memory size (API string)","Able to identify Internet Explorer version from registry","Contains ability to read software policies","Contains ability to retrieve the host's architecture (API string)","Contains ability to retrieve state data for the computer (API string)","Reads information about supported languages","Calls an API typically used to get system version information"],"parent":null},{"tactic":"Discovery","technique":"System Location Discovery","attck_id":"T1614","attck_id_wiki":"https://attack.mitre.org/techniques/T1614","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to query system locale information (API string)"],"parent":null},{"tactic":"Discovery","technique":"Time Based Evasion","attck_id":"T1497.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1497/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Contains ability to delay execution by waiting for signal/timeout (API string)","Contains ability to retrieve the time elapsed since the system was started (API string)","Contains ability to delay the execution of current thread"],"parent":{"technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497"}},{"tactic":"Discovery","technique":"System Time Discovery","attck_id":"T1124","attck_id_wiki":"https://attack.mitre.org/techniques/T1124","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Contains ability to retrieve machine time (API string)","Able to retrieve date formats supported by the local system (API string)","Contains ability to query machine time"],"parent":null},{"tactic":"Discovery","technique":"User Activity Based Checks","attck_id":"T1497.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1497/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Able to identify virtual environment by using user activity (API string)","Able to identify virtual environment using user register activity"],"parent":{"technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497"}},{"tactic":"Discovery","technique":"System Checks","attck_id":"T1497.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1497/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Able to identify virtual/sandbox environment","Able to identify virtual environment by using API string"],"parent":{"technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497"}},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attck_id":"T1016","attck_id_wiki":"https://attack.mitre.org/techniques/T1016","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":8,"informative_identifiers":["Contains ability retrieve IPv4 mapping information (API string)","Contains ability to query network adapter information (API string)","Able to determine NetBIOS or DNS name associated with the local computer","Contains ability to retrieve configuration of a workstation (API string)","Contains ability to retrieve network parameters of a computer (API string)","Contains ability to free the memory used by network management functions (API string)","Able to retrieve name of the domain controller for the current domain (API string)","Contains ability to retrieve internet settings (API string)"],"parent":null},{"tactic":"Discovery","technique":"System Owner/User Discovery","attck_id":"T1033","attck_id_wiki":"https://attack.mitre.org/techniques/T1033","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Contains ability to retrieve usernames and/or user information (API string)","Contains ability to retrieve user privileges (API string)","Able to query security token membership for user discovery (API string)"],"parent":null},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Able to identify sandbox environment running process","Contains ability to detect presence of virtual environment (API string)","Contains ability to detect virtual environment (API)"],"parent":null},{"tactic":"Discovery","technique":"Application Window Discovery","attck_id":"T1010","attck_id_wiki":"https://attack.mitre.org/techniques/T1010","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Contains ability to retrieve open application windows (API string)","Able to identify virtual box environment","Contains ability to find open windows (API string)"],"parent":null},{"tactic":"Discovery","technique":"System Service Discovery","attck_id":"T1007","attck_id_wiki":"https://attack.mitre.org/techniques/T1007","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Able to query service configuration on system (API string)","Able to enumerate service (API string)"],"parent":null},{"tactic":"Discovery","technique":"Remote System Discovery","attck_id":"T1018","attck_id_wiki":"https://attack.mitre.org/techniques/T1018","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to retrieve remote session information (API string)"],"parent":null},{"tactic":"Discovery","technique":"System Network Connections Discovery","attck_id":"T1049","attck_id_wiki":"https://attack.mitre.org/techniques/T1049","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Contains ability to enumerate logon sessions (API string)","Contains ability to retrieve IPv4 TCP connection table (API string)","Contains ability to enumerate network resources (API string)"],"parent":null},{"tactic":"Discovery","technique":"Account Discovery","attck_id":"T1087","attck_id_wiki":"https://attack.mitre.org/techniques/T1087","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to retrieve SID for the specified name (API string)"],"parent":null},{"tactic":"Discovery","technique":"Local Account","attck_id":"T1087.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1087/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to retrieve information about user accounts on a server (API string)"],"parent":{"technique":"Account Discovery","attck_id":"T1087","attck_id_wiki":"https://attack.mitre.org/techniques/T1087"}},{"tactic":"Discovery","technique":"Security Software Discovery","attck_id":"T1518.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1518/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Possibly checks for known debuggers/analysis tools"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Software Discovery","attck_id":"T1518","attck_id_wiki":"https://attack.mitre.org/techniques/T1518"}},{"tactic":"Discovery","technique":"Network Share Discovery","attck_id":"T1135","attck_id_wiki":"https://attack.mitre.org/techniques/T1135","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to query information about shared network resources (API string)","Able to access Windows networking-related API (String)"],"parent":null},{"tactic":"Discovery","technique":"System Language Discovery","attck_id":"T1614.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1614/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Able to retrieve system language (API string)","Able to retrieve the current system language","Reads the windows installation language"],"parent":{"technique":"System Location Discovery","attck_id":"T1614","attck_id_wiki":"https://attack.mitre.org/techniques/T1614"}},{"tactic":"Discovery","technique":"Domain Trust Discovery","attck_id":"T1482","attck_id_wiki":"https://attack.mitre.org/techniques/T1482","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to retrieve Domain Trust data (API string)"],"parent":null},{"tactic":"Discovery","technique":"Wi-Fi Discovery","attck_id":"T1016.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1016/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains Wi-Fi native api calls"],"parent":{"technique":"System Network Configuration Discovery","attck_id":"T1016","attck_id_wiki":"https://attack.mitre.org/techniques/T1016"}},{"tactic":"Discovery","technique":"Debugger Evasion","attck_id":"T1622","attck_id_wiki":"https://attack.mitre.org/techniques/T1622","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to register a top-level exception handler (often used as anti-debugging trick)"],"parent":null},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attck_id":"T1570","attck_id_wiki":"https://attack.mitre.org/techniques/T1570","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to move file or directory (API string)"],"parent":null},{"tactic":"Lateral Movement","technique":"Remote Services","attck_id":"T1021","attck_id_wiki":"https://attack.mitre.org/techniques/T1021","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to register RPC protocol sequence (API string)"],"parent":null},{"tactic":"Collection","technique":"Data from Information Repositories","attck_id":"T1213","attck_id_wiki":"https://attack.mitre.org/techniques/T1213","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains SQL queries"],"parent":null},{"tactic":"Collection","technique":"Screen Capture","attck_id":"T1113","attck_id_wiki":"https://attack.mitre.org/techniques/T1113","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to capture screen (API string)"],"parent":null},{"tactic":"Collection","technique":"Local Data Staging","attck_id":"T1074.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1074/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to create directories (API string)"],"parent":{"technique":"Data Staged","attck_id":"T1074","attck_id_wiki":"https://attack.mitre.org/techniques/T1074"}},{"tactic":"Collection","technique":"Keylogging","attck_id":"T1056.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1056/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to hook/unhook windows functions (API string)","Able to retrieve information about pressed keystrokes (API string)"],"parent":{"technique":"Input Capture","attck_id":"T1056","attck_id_wiki":"https://attack.mitre.org/techniques/T1056"}},{"tactic":"Collection","technique":"Clipboard Data","attck_id":"T1115","attck_id_wiki":"https://attack.mitre.org/techniques/T1115","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Able to capture drag-drop file operations","Contains ability to access clipboard data (API string)"],"parent":null},{"tactic":"Collection","technique":"Archive via Library","attck_id":"T1560.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1560/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to compress/decompress buffers (API string)","Able to compress/decompress content at runtime"],"parent":{"technique":"Archive Collected Data","attck_id":"T1560","attck_id_wiki":"https://attack.mitre.org/techniques/T1560"}},{"tactic":"Collection","technique":"Automated Collection","attck_id":"T1119","attck_id_wiki":"https://attack.mitre.org/techniques/T1119","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Shows ability to send encrypted data to the internet"],"parent":null},{"tactic":"Command and Control","technique":"Application Layer Protocol","attck_id":"T1071","attck_id_wiki":"https://attack.mitre.org/techniques/T1071","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":7,"informative_identifiers":["Found potential URL in binary/memory","Found potential IP address in binary/memory","Contains ability to create a new HTTP request (API string)","Found potential URLs in memory dumps","Contains ability to communicate with network (API string)","Contains ability to create a HTTP or FTP session (API string)","Contains references to network communication API (string)"],"parent":null},{"tactic":"Command and Control","technique":"Mail Protocols","attck_id":"T1071.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1071/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Found mail related domain names"],"parent":{"technique":"Application Layer Protocol","attck_id":"T1071","attck_id_wiki":"https://attack.mitre.org/techniques/T1071"}},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attck_id":"T1105","attck_id_wiki":"https://attack.mitre.org/techniques/T1105","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to write files (API string)","Contains ability to download a file from a URL (API string)"],"parent":null},{"tactic":"Command and Control","technique":"Encrypted Channel","attck_id":"T1573","attck_id_wiki":"https://attack.mitre.org/techniques/T1573","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":2,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attck_id":"T1095","attck_id_wiki":"https://attack.mitre.org/techniques/T1095","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to communicate with C2 using Sockets (API string)"],"parent":null},{"tactic":"Command and Control","technique":"Web Protocols","attck_id":"T1071.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1071/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Attempts to call internet-related API for network communication"],"informative_identifiers_count":3,"informative_identifiers":["Contains ability to set options for internet handles (API string)","Contains reference to Windows internet services (API string)","Contains reference to Windows HTTP services (API string)"],"parent":{"technique":"Application Layer Protocol","attck_id":"T1071","attck_id_wiki":"https://attack.mitre.org/techniques/T1071"}},{"tactic":"Command and Control","technique":"Proxy","attck_id":"T1090","attck_id_wiki":"https://attack.mitre.org/techniques/T1090","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains references to RPC protocol sequence strings"],"parent":null},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attck_id":"T1573.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1573/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Shows ability to use encryption for command and control traffic"],"parent":{"technique":"Encrypted Channel","attck_id":"T1573","attck_id_wiki":"https://attack.mitre.org/techniques/T1573"}},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attck_id":"T1029","attck_id_wiki":"https://attack.mitre.org/techniques/T1029","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to perform scheduled transfer (API string)"],"parent":null},{"tactic":"Impact","technique":"Service Stop","attck_id":"T1489","attck_id_wiki":"https://attack.mitre.org/techniques/T1489","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Contains ability to terminate a process"],"informative_identifiers_count":4,"informative_identifiers":["Contains ability to terminate a process (API string)","Able to retrieve/open a process (API string)","Able to change the configuration parameters of a service","Contains ability to close a handle to a service (API string)"],"parent":null},{"tactic":"Impact","technique":"Data Encrypted for Impact","attck_id":"T1486","attck_id_wiki":"https://attack.mitre.org/techniques/T1486","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to perform encryption (API string)","Able to access crypto-related API (String)"],"parent":null},{"tactic":"Impact","technique":"System Shutdown/Reboot","attck_id":"T1529","attck_id_wiki":"https://attack.mitre.org/techniques/T1529","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to reboot/shutdown the operating system (API string)"],"parent":null}],"network_mode":"default","signatures":[{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-935","type":2,"relevance":1,"name":"Able to compress/decompress content at runtime","description":"Found string \"video 4.4 Decompression Filter\" (Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")\n Found string \"video 5.10 Decompression Filter\" (Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")\n Found string \"SDB compression algorithm does not match callback algorithm.\" (Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp\")","description_v2":["Found string \"video 4.4 Decompression Filter\" (Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found string \"video 5.10 Decompression Filter\" (Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found string \"SDB compression algorithm does not match callback algorithm.\" (Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"video 4.4 Decompression Filter\" (Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"video 5.10 Decompression Filter\" (Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"SDB compression algorithm does not match callback algorithm.\" (Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1560.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1560/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-92","type":2,"relevance":1,"name":"Able to inject code into another process (API string)","description":"$26","description_v2":["Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"CreateThreadpoolWait\" (Indicator: \"CreateThread\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"CreateThreadpoolWork\" (Indicator: \"CreateThread\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.74893000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")","Found reference to API \"NtAllocateVirtualMemory\" (Indicator: \"AllocateVirtualMemory\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")","Found reference to API \"NtWriteVirtualMemory\" (Indicator: \"WriteVirtualMemory\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")","Found reference to API \"NtWriteVirtualMemory\" (Indicator: \"NtWriteVirtualMemory\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")","Found reference to API \"NtCreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")","Found reference to API \"NtCreateThreadEx\" (Indicator: \"CreateThread\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")","Found reference to API \"NtMapViewOfSection\" (Indicator: \"NtMapViewOfSection\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")","Found reference to API \"NtAllocateVirtualMemoryEx\" (Indicator: \"AllocateVirtualMemory\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"NtMapViewOfSectionEx\" (Indicator: \"NtMapViewOfSection\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"ZwMapViewOfSection\" (Indicator: \"ZwMapViewOfSection\"; Source: \"00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")","Found reference to API \"DsRoleFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","$27","Found reference to API \"WriteProcessMemory\" (Indicator: \"WriteProcessMemory\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"NS_BIOSRead::APIHook_NtMapViewOfSection\" (Indicator: \"NtMapViewOfSection\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"ZwMapViewOfSection failed to map the end of the file [%x]\" (Indicator: \"ZwMapViewOfSection\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp\")","Found reference to API \"ZwMapViewOfSection failed to map the start of the file [%x]\" (Indicator: \"ZwMapViewOfSection\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateThreadpoolWait\" (Indicator: \"CreateThread\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateThreadpoolWork\" (Indicator: \"CreateThread\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.74893000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NtAllocateVirtualMemory\" (Indicator: \"AllocateVirtualMemory\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NtWriteVirtualMemory\" (Indicator: \"WriteVirtualMemory\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NtWriteVirtualMemory\" (Indicator: \"NtWriteVirtualMemory\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NtCreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NtCreateThreadEx\" (Indicator: \"CreateThread\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NtMapViewOfSection\" (Indicator: \"NtMapViewOfSection\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NtAllocateVirtualMemoryEx\" (Indicator: \"AllocateVirtualMemory\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NtMapViewOfSectionEx\" (Indicator: \"NtMapViewOfSection\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ZwMapViewOfSection\" (Indicator: \"ZwMapViewOfSection\"; Source: \"00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"DsRoleFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"$28"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WriteProcessMemory\" (Indicator: \"WriteProcessMemory\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_BIOSRead::APIHook_NtMapViewOfSection\" (Indicator: \"NtMapViewOfSection\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ZwMapViewOfSection failed to map the end of the file [%x]\" (Indicator: \"ZwMapViewOfSection\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ZwMapViewOfSection failed to map the start of the file [%x]\" (Indicator: \"ZwMapViewOfSection\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1055","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1055","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-738","type":2,"relevance":1,"name":"Able to remove the event logs","description":"Found reference to API \"EvtClearLog\" (Indicator: \"evtclearlog\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")\n Found reference to API \"EvtSetChannelConfigProperty\" (Indicator: \"evtsetchannelconfigproperty\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","description_v2":["Found reference to API \"EvtClearLog\" (Indicator: \"evtclearlog\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"EvtSetChannelConfigProperty\" (Indicator: \"evtsetchannelconfigproperty\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"EvtClearLog\" (Indicator: \"evtclearlog\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"EvtSetChannelConfigProperty\" (Indicator: \"evtsetchannelconfigproperty\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1070.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1070/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-404","type":2,"relevance":1,"name":"Contains ability to compress/decompress buffers (API string)","description":"Found reference to API \"RtlCompressBuffer\" (Indicator: \"RtlCompressBuffer\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")\n Found reference to API \"RtlDecompressBuffer\" (Indicator: \"RtlDecompressBuffer\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")\n Found reference to API \"RtlDecompressBufferEx\" (Indicator: \"RtlDecompressBuffer\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")","description_v2":["Found reference to API \"RtlCompressBuffer\" (Indicator: \"RtlCompressBuffer\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")","Found reference to API \"RtlDecompressBuffer\" (Indicator: \"RtlDecompressBuffer\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")","Found reference to API \"RtlDecompressBufferEx\" (Indicator: \"RtlDecompressBuffer\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"RtlCompressBuffer\" (Indicator: \"RtlCompressBuffer\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RtlDecompressBuffer\" (Indicator: \"RtlDecompressBuffer\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RtlDecompressBufferEx\" (Indicator: \"RtlDecompressBuffer\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1560.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1560/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-79","type":2,"relevance":1,"name":"Contains ability to create a remote thread (API string)","description":"$29","description_v2":["Found reference to API \"hook_CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"NtCreateThread\" (Indicator: \"NtCreateThread\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")","Found reference to API \"NtCreateThreadEx\" (Indicator: \"NtCreateThread\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"hook_CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NtCreateThread\" (Indicator: \"NtCreateThread\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NtCreateThreadEx\" (Indicator: \"NtCreateThread\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1055.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1055/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-226","type":2,"relevance":1,"name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$2a","description_v2":["$2b","$2c","$2d","Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount64\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","$2e","$2f","$30","Found reference to API \"IcmpSendEcho\" (Indicator: \"IcmpSendEcho\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74701000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"CreateTimerQueueTimer\" (Indicator: \"CreateTimerQueueTimer\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"QueryPerformanceFrequency\" (Indicator: \"QueryPerformanceFrequency\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"SetWaitableTimer\" (Indicator: \"SetWaitableTimer\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"NtWaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.74736000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")","Found reference to API \"NtWaitForSingleObject\" (Indicator: \"NtWaitForSingleObject\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.74736000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")","Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"NtDelayExecution\" (Indicator: \"NtDelayExecution\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")","Found reference to API \"NtWaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")","Found reference to API \"NtWaitForMultipleObjects\" (Indicator: \"NtWaitForMultipleObjects\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")","Found reference to API \"MsgWaitForMultipleObjectsEx\" (Indicator: \"WaitForMultipleObjects\"; Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76501000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"MsgWaitForMultipleObjectsEx\" (Indicator: \"WaitForMultipleObjectsEx\"; Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76501000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"MsgWaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"RegisterWaitForSingleObjectEx\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"RegisterWaitForSingleObjectEx\" (Indicator: \"WaitForSingleObjectEx\"; Source: \"00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"$31"},{"type":"linebreak"},{"type":"text","value":"$32"},{"type":"linebreak"},{"type":"text","value":"$33"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount64\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"$34"},{"type":"linebreak"},{"type":"text","value":"$35"},{"type":"linebreak"},{"type":"text","value":"$36"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"IcmpSendEcho\" (Indicator: \"IcmpSendEcho\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74701000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateTimerQueueTimer\" (Indicator: \"CreateTimerQueueTimer\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"QueryPerformanceFrequency\" (Indicator: \"QueryPerformanceFrequency\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetWaitableTimer\" (Indicator: \"SetWaitableTimer\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NtWaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.74736000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NtWaitForSingleObject\" (Indicator: \"NtWaitForSingleObject\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.74736000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NtDelayExecution\" (Indicator: \"NtDelayExecution\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NtWaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NtWaitForMultipleObjects\" (Indicator: \"NtWaitForMultipleObjects\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"MsgWaitForMultipleObjectsEx\" (Indicator: \"WaitForMultipleObjects\"; Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76501000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"MsgWaitForMultipleObjectsEx\" (Indicator: \"WaitForMultipleObjectsEx\"; Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76501000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"MsgWaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RegisterWaitForSingleObjectEx\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RegisterWaitForSingleObjectEx\" (Indicator: \"WaitForSingleObjectEx\"; Source: \"00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1497.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1497/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-253","type":2,"relevance":1,"name":"Contains ability to detect presence of virtual environment (API string)","description":"$37","description_v2":["Found reference to API \"SetupDiGetClassDevsA\" (Indicator: \"SetupDiGetClassDevs\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"SetupDiGetClassDevsW\" (Indicator: \"SetupDiGetClassDevs\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74D81000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"SetupDiEnumDeviceInfo\" (Indicator: \"SetupDiEnumDeviceInfo\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"SetupDiGetDeviceRegistryPropertyA\" (Indicator: \"SetupDiGetDeviceRegistryProperty\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp\")","Found reference to API \"SetupDiGetDeviceRegistryPropertyW\" (Indicator: \"SetupDiGetDeviceRegistryProperty\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"SetupDiGetClassDevsA\" (Indicator: \"SetupDiGetClassDevs\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetupDiGetClassDevsW\" (Indicator: \"SetupDiGetClassDevs\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74D81000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetupDiEnumDeviceInfo\" (Indicator: \"SetupDiEnumDeviceInfo\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetupDiGetDeviceRegistryPropertyA\" (Indicator: \"SetupDiGetDeviceRegistryProperty\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetupDiGetDeviceRegistryPropertyW\" (Indicator: \"SetupDiGetDeviceRegistryProperty\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1497","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1497","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-306","type":2,"relevance":1,"name":"Contains ability to impersonate access tokens (API string)","description":"$38","description_v2":["Found reference to API \"NtImpersonateThread\" (Indicator: \"NtImpersonateThread\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")","Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")","Found reference to API \"NtOpenThreadToken\" (Indicator: \"OpenThreadToken\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.74736000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")","$39","$3a","Found reference to API \"SetThreadToken\" (Indicator: \"SetThreadToken\"; Source: \"00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"[GetStringSID] Failed to OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NtOpenProcessToken failed [%x]\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"NtImpersonateThread\" (Indicator: \"NtImpersonateThread\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NtOpenThreadToken\" (Indicator: \"OpenThreadToken\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.74736000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"$3b"},{"type":"linebreak"},{"type":"text","value":"$3c"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetThreadToken\" (Indicator: \"SetThreadToken\"; Source: \"00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"[GetStringSID] Failed to OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NtOpenProcessToken failed [%x]\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1134.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1134/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-318","type":2,"relevance":1,"name":"Contains ability to load/free library (API string)","description":"$3d","description_v2":["$3e","$3f","$40","Found reference to API \"FreeLibraryWhenCallbackReturns\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"FreeLibraryAndExitThread\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"LoadLibraryCWD\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_ForceDXSetupSuccess::APIHook_LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_ForceDXSetupSuccess::APIHook_LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_ForceDXSetupSuccess::APIHook_LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_ForceDXSetupSuccess::APIHook_LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_ForceDXSetupSuccess::APIHook_FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_LoadLibraryCWD::NotifyFn\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_LoadLibraryCWD::InitializeHooksMulti\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"$41"},{"type":"linebreak"},{"type":"text","value":"$42"},{"type":"linebreak"},{"type":"text","value":"$43"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FreeLibraryWhenCallbackReturns\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FreeLibraryAndExitThread\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryCWD\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_ForceDXSetupSuccess::APIHook_LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_ForceDXSetupSuccess::APIHook_LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_ForceDXSetupSuccess::APIHook_LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_ForceDXSetupSuccess::APIHook_LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_ForceDXSetupSuccess::APIHook_FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_LoadLibraryCWD::NotifyFn\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_LoadLibraryCWD::InitializeHooksMulti\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1055.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1055/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-304","type":2,"relevance":1,"name":"Contains ability to modify registry key/value (API string)","description":"$44","description_v2":["Found reference to API \"\" (Indicator: \"RegSetValue\"; Source: \"00000000-00007376.00000000.113264.00680000.00000004.mdmp\")","Found reference to API \"\" (Indicator: \"RegSetValue\"; Source: \"00000000-00007376.00000000.113264.00680000.00000004.mdmp\")","Found reference to API \"\" (Indicator: \"RegSetValue\"; Source: \"00000000-00007376.00000000.113264.00680000.00000004.mdmp\")","Found reference to API \"\" (Indicator: \"RegSetValue\"; Source: \"00000000-00007376.00000000.113264.00680000.00000004.mdmp\")","Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","$45","Found reference to API \"RegSetKeyValueW\" (Indicator: \"RegSetKeyValue\"; Source: \"00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"RegSetValueExW: wrp key is mitigated\" (Indicator: \"RegSetValue\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"RegSetValueA: wrp key is mitigated\" (Indicator: \"RegSetValue\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"RegSetValueW: wrp key is mitigated\" (Indicator: \"RegSetValue\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"RegSetValueExA: wrp key is mitigated\" (Indicator: \"RegSetValue\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"RegSetValueA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"RegSetValueW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.777D1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"SpellIt: RegSetValueEx failed\" (Indicator: \"RegSetValue\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"RegSetKeyValueA\" (Indicator: \"RegSetKeyValue\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"\" (Indicator: \"RegSetValue\"; Source: \"00000000-00007376.00000000.113264.00680000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"\" (Indicator: \"RegSetValue\"; Source: \"00000000-00007376.00000000.113264.00680000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"\" (Indicator: \"RegSetValue\"; Source: \"00000000-00007376.00000000.113264.00680000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"\" (Indicator: \"RegSetValue\"; Source: \"00000000-00007376.00000000.113264.00680000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"$46"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RegSetKeyValueW\" (Indicator: \"RegSetKeyValue\"; Source: \"00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RegSetValueExW: wrp key is mitigated\" (Indicator: \"RegSetValue\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RegSetValueA: wrp key is mitigated\" (Indicator: \"RegSetValue\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RegSetValueW: wrp key is mitigated\" (Indicator: \"RegSetValue\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RegSetValueExA: wrp key is mitigated\" (Indicator: \"RegSetValue\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RegSetValueA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RegSetValueW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.777D1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SpellIt: RegSetValueEx failed\" (Indicator: \"RegSetValue\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RegSetKeyValueA\" (Indicator: \"RegSetKeyValue\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1112","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1112","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-192","type":2,"relevance":1,"name":"Contains ability to modify system service (API string)","description":"$47","description_v2":["Found reference to API \"hook_ControlService\" (Indicator: \"ControlService\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"ControlService\" (Indicator: \"ControlService\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"ChangeServiceConfigA\" (Indicator: \"ChangeServiceConfig\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.74BC1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"ChangeServiceConfigW\" (Indicator: \"ChangeServiceConfig\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"hook_ControlService\" (Indicator: \"ControlService\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ControlService\" (Indicator: \"ControlService\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ChangeServiceConfigA\" (Indicator: \"ChangeServiceConfig\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.74BC1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ChangeServiceConfigW\" (Indicator: \"ChangeServiceConfig\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1543.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1543/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-544","type":2,"relevance":1,"name":"Contains ability to open a service (API string)","description":"$48","description_v2":["Found reference to API \"hook_OpenServiceA\" (Indicator: \"OpenService\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"hook_OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"OpenServiceA\" (Indicator: \"OpenService\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.74BC1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"hook_OpenServiceA\" (Indicator: \"OpenService\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"hook_OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"OpenServiceA\" (Indicator: \"OpenService\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.74BC1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1569.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1569/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-320","type":2,"relevance":1,"name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.76501000.00000020.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","description_v2":["Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.76501000.00000020.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.76501000.00000020.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1564.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1564/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-409","type":2,"relevance":1,"name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","description_v2":["Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1070.006","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1070/006","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-90","type":2,"relevance":1,"name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")\n Found reference to API \"ZwUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")\n Found reference to API \"NS_BIOSRead::APIHook_NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","description_v2":["Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")","Found reference to API \"ZwUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")","Found reference to API \"NS_BIOSRead::APIHook_NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ZwUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_BIOSRead::APIHook_NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1055.012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1055/012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-138","type":2,"relevance":2,"name":"Contains ability to use Cryptographic classes","description":"Found reference to \"SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00007376.00000000.113264.72F31000.00000020.mdmp, 00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.74841000.00000020.mdmp\")\n Found reference to \"SHA512\" (Indicator: \"SHA512\"; Source: \"00000000-00007376.00000000.113264.72F31000.00000020.mdmp, 00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.74841000.00000020.mdmp\")\n Found reference to \"SP800_108_CTR_HMAC\" (Indicator: \"HMAC\"; Source: \"00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.74841000.00000020.mdmp\")","description_v2":["Found reference to \"SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00007376.00000000.113264.72F31000.00000020.mdmp, 00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.74841000.00000020.mdmp\")","Found reference to \"SHA512\" (Indicator: \"SHA512\"; Source: \"00000000-00007376.00000000.113264.72F31000.00000020.mdmp, 00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.74841000.00000020.mdmp\")","Found reference to \"SP800_108_CTR_HMAC\" (Indicator: \"HMAC\"; Source: \"00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.74841000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to \"SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00007376.00000000.113264.72F31000.00000020.mdmp, 00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.74841000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"SHA512\" (Indicator: \"SHA512\"; Source: \"00000000-00007376.00000000.113264.72F31000.00000020.mdmp, 00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.74841000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"SP800_108_CTR_HMAC\" (Indicator: \"HMAC\"; Source: \"00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.74841000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-231","type":2,"relevance":1,"name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \"AmsiScanBuffer\" (Indicator: \"amsiscanbuffer\") in Source: 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\n Observed string: \"Added exception handler due to AMSI.dll protection: %p\" (Indicator: \"amsi.dll\") in Source: 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp","description_v2":["Observed string: \"AmsiScanBuffer\" (Indicator: \"amsiscanbuffer\") in Source: 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp","Observed string: \"Added exception handler due to AMSI.dll protection: %p\" (Indicator: \"amsi.dll\") in Source: 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp"],"description_v3":[{"type":"text","value":"Observed string: \"AmsiScanBuffer\" (Indicator: \"amsiscanbuffer\") in Source: 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"Observed string: \"Added exception handler due to AMSI.dll protection: %p\" (Indicator: \"amsi.dll\") in Source: 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp"}],"origin":"File/Memory","attck_id":"T1562.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1562/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-145","type":2,"relevance":1,"name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\FltMgr; Source: \"00000000-00007376.00000000.113264.74431000.00000020.mdmp\")","description_v2":["Found string - \\\\.\\FltMgr; Source: \"00000000-00007376.00000000.113264.74431000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found string - \\\\.\\FltMgr; Source: \"00000000-00007376.00000000.113264.74431000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1564","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1564","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Reverse Engineering","identifier":"stream-4","type":1,"relevance":1,"name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNELBASE.DLL at 00000000-00007376-36839-13-00D23460\n SetUnhandledExceptionFilter@KERNELBASE.DLL at 00000000-00007376-36839-16-00D23210","description_v2":["SetUnhandledExceptionFilter@KERNELBASE.DLL at 00000000-00007376-36839-13-00D23460","SetUnhandledExceptionFilter@KERNELBASE.DLL at 00000000-00007376-36839-16-00D23210"],"description_v3":[{"type":"text","value":"SetUnhandledExceptionFilter@KERNELBASE.DLL"},{"type":"pid","pid":"00007376"},{"type":"linebreak"},{"type":"text","value":"SetUnhandledExceptionFilter@KERNELBASE.DLL"},{"type":"pid","pid":"00007376"}],"origin":"Hybrid Analysis Technology","attck_id":"T1622","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1622","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Reverse Engineering","identifier":"stream-41","type":1,"relevance":10,"name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API SetProcessDPIAware@USER32.DLL at 00000000-00007376-36839-24-00D21C84","description_v2":["Found reference to API SetProcessDPIAware@USER32.DLL at 00000000-00007376-36839-24-00D21C84"],"description_v3":[{"type":"text","value":"Found reference to API SetProcessDPIAware@USER32.DLL"},{"type":"stream","stream_uid":"00000000-00007376-36839-24-00D21C84","modal_link":"/bff/report/68b8504446b83fb2480c50bd/processes/00000000-00007376/streams/0/00000000-00007376-36839-24-00D21C84","process":{"name":"regsvr32.exe","process_uid":"00000000-00007376","pid":"7376"}}],"origin":"Hybrid Analysis Technology","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":{"modal_link":"/bff/report/68b8504446b83fb2480c50bd/processes/00000000-00007376/streams/0/00000000-00007376-36839-24-00D21C84","name":"regsvr32.exe","pid":7376}},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"string-920","type":2,"relevance":1,"name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptProtectData\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","description_v2":["Found reference to API \"CryptProtectData\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CryptProtectData\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1486","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1486","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"string-927","type":2,"relevance":1,"name":"Able to utilize the Windows bcrypt cryptographic API","description":"$49","description_v2":["Found reference to API \"BCryptEncrypt\" (Indicator: \"BCryptEncrypt\"; Source: \"00000000-00007376.00000000.113264.72F31000.00000020.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"BCryptDestroyKey\" (Indicator: \"BCryptDestroyKey\"; Source: \"00000000-00007376.00000000.113264.72F31000.00000020.mdmp, 00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"BCryptGenerateSymmetricKey\" (Indicator: \"BCryptGenerateSymmetricKey\"; Source: \"00000000-00007376.00000000.113264.72F31000.00000020.mdmp, 00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"BCryptImportKeyPair\" (Indicator: \"BCryptImportKey\"; Source: \"00000000-00007376.00000000.113264.72F31000.00000020.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"00000000-00007376.00000000.113264.72F31000.00000020.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp\")","Found reference to API \"BCryptCloseAlgorithmProvider\" (Indicator: \"BCryptCloseAlgorithmProvider\"; Source: \"00000000-00007376.00000000.113264.72F31000.00000020.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"BCryptImportKey\" (Indicator: \"BCryptImportKey\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"BCryptGenerateKeyPair\" (Indicator: \"BCryptGenerateKeyPair\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"BCryptEncrypt\" (Indicator: \"BCryptEncrypt\"; Source: \"00000000-00007376.00000000.113264.72F31000.00000020.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"BCryptDestroyKey\" (Indicator: \"BCryptDestroyKey\"; Source: \"00000000-00007376.00000000.113264.72F31000.00000020.mdmp, 00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"BCryptGenerateSymmetricKey\" (Indicator: \"BCryptGenerateSymmetricKey\"; Source: \"00000000-00007376.00000000.113264.72F31000.00000020.mdmp, 00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"BCryptImportKeyPair\" (Indicator: \"BCryptImportKey\"; Source: \"00000000-00007376.00000000.113264.72F31000.00000020.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"00000000-00007376.00000000.113264.72F31000.00000020.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"BCryptCloseAlgorithmProvider\" (Indicator: \"BCryptCloseAlgorithmProvider\"; Source: \"00000000-00007376.00000000.113264.72F31000.00000020.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"BCryptImportKey\" (Indicator: \"BCryptImportKey\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"BCryptGenerateKeyPair\" (Indicator: \"BCryptGenerateKeyPair\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"stream-139","type":1,"relevance":0,"name":"Contains XOR operation loops [Stream disassembly]","description":"$4a","description_v2":["Assembly shows XOR instruction xor eax","ebp in Stream UID: 00000000-00007376-36839-20-00D21F2B","Assembly shows XOR instruction xor ecx","ebp in Stream UID: 00000000-00007376-36839-20-00D21F2B","Assembly shows XOR instruction xor eax","ebp in Stream UID: 00000000-00007376-36839-24-00D21C84","Assembly shows XOR instruction xor ecx","ebp in Stream UID: 00000000-00007376-36839-24-00D21C84","Assembly shows XOR instruction xor eax","ebp in Stream UID: 00000000-00007376-36839-27-00D21962","Assembly shows XOR instruction xor ecx","ebp in Stream UID: 00000000-00007376-36839-27-00D21962","Assembly shows XOR instruction xor eax","esp in Stream UID: 00000000-00007376-36839-28-00D218B0","Assembly shows XOR instruction xor ecx","esp in Stream UID: 00000000-00007376-36839-28-00D218B0","Assembly shows XOR instruction xor eax","ebp in Stream UID: 00000000-00007376-36839-29-00D21DAF","Assembly shows XOR instruction xor ecx","ebp in Stream UID: 00000000-00007376-36839-29-00D21DAF","Assembly shows XOR instruction xor eax","dword ptr [ebp-0Ch] in Stream UID: 00000000-00007376-36839-31-00D23663","Assembly shows XOR instruction xor dword ptr [ebp-04h]","eax in Stream UID: 00000000-00007376-36839-31-00D23663","Assembly shows XOR instruction xor eax","dword ptr [ebp-04h] in Stream UID: 00000000-00007376-36839-31-00D23663","Assembly shows XOR instruction xor eax","ecx in Stream UID: 00000000-00007376-36839-31-00D23663","Assembly shows XOR instruction xor eax","dword ptr [ebp-14h] in Stream UID: 00000000-00007376-36839-31-00D23663","Assembly shows XOR instruction xor ecx","eax in Stream UID: 00000000-00007376-36839-31-00D23663","Assembly shows XOR instruction xor eax","ebp in Stream UID: 00000000-00007376-36839-53-00D22C5A","Assembly shows XOR instruction xor ecx","ebp in Stream UID: 00000000-00007376-36839-53-00D22C5A"],"description_v3":[{"type":"text","value":"Assembly shows XOR instruction xor eax"},{"type":"linebreak"},{"type":"text","value":"ebp in Stream UID: 00000000-00007376-36839-20-00D21F2B"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor ecx"},{"type":"linebreak"},{"type":"text","value":"ebp in Stream UID: 00000000-00007376-36839-20-00D21F2B"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor eax"},{"type":"linebreak"},{"type":"text","value":"ebp in Stream UID: 00000000-00007376-36839-24-00D21C84"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor ecx"},{"type":"linebreak"},{"type":"text","value":"ebp in Stream UID: 00000000-00007376-36839-24-00D21C84"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor eax"},{"type":"linebreak"},{"type":"text","value":"ebp in Stream UID: 00000000-00007376-36839-27-00D21962"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor ecx"},{"type":"linebreak"},{"type":"text","value":"ebp in Stream UID: 00000000-00007376-36839-27-00D21962"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor eax"},{"type":"linebreak"},{"type":"text","value":"esp in Stream UID: 00000000-00007376-36839-28-00D218B0"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor ecx"},{"type":"linebreak"},{"type":"text","value":"esp in Stream UID: 00000000-00007376-36839-28-00D218B0"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor eax"},{"type":"linebreak"},{"type":"text","value":"ebp in Stream UID: 00000000-00007376-36839-29-00D21DAF"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor ecx"},{"type":"linebreak"},{"type":"text","value":"ebp in Stream UID: 00000000-00007376-36839-29-00D21DAF"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor eax"},{"type":"linebreak"},{"type":"text","value":"dword ptr [ebp-0Ch] in Stream UID: 00000000-00007376-36839-31-00D23663"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor dword ptr [ebp-04h]"},{"type":"linebreak"},{"type":"text","value":"eax in Stream UID: 00000000-00007376-36839-31-00D23663"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor eax"},{"type":"linebreak"},{"type":"text","value":"dword ptr [ebp-04h] in Stream UID: 00000000-00007376-36839-31-00D23663"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor eax"},{"type":"linebreak"},{"type":"text","value":"ecx in Stream UID: 00000000-00007376-36839-31-00D23663"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor eax"},{"type":"linebreak"},{"type":"text","value":"dword ptr [ebp-14h] in Stream UID: 00000000-00007376-36839-31-00D23663"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor ecx"},{"type":"linebreak"},{"type":"text","value":"eax in Stream UID: 00000000-00007376-36839-31-00D23663"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor eax"},{"type":"linebreak"},{"type":"text","value":"ebp in Stream UID: 00000000-00007376-36839-53-00D22C5A"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor ecx"},{"type":"linebreak"},{"type":"text","value":"ebp in Stream UID: 00000000-00007376-36839-53-00D22C5A"}],"origin":"Hybrid Analysis Technology","attck_id":"T1027.005","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027/005","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"string-213","type":2,"relevance":1,"name":"Contains ability to encrypt/encode message (API string)","description":"Found reference to API \"EncryptMessage\" (Indicator: \"EncryptMessage\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74741000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")\n Found reference to API \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")\n Found reference to API \"CryptStringToBinaryW\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","description_v2":["Found reference to API \"EncryptMessage\" (Indicator: \"EncryptMessage\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74741000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"CryptStringToBinaryW\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"EncryptMessage\" (Indicator: \"EncryptMessage\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74741000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CryptStringToBinaryW\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"string-212","type":2,"relevance":1,"name":"Contains ability to perform decryption (API string)","description":"$4b","description_v2":["Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00007376.00000000.113264.72F31000.00000020.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"DecryptMessage\" (Indicator: \"DecryptMessage\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74741000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"BCryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00007376.00000000.113264.72F31000.00000020.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"DecryptMessage\" (Indicator: \"DecryptMessage\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74741000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"BCryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1140","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1140","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"string-108","type":2,"relevance":1,"name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"CryptProtectData\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","description_v2":["Found reference to API \"CryptProtectData\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CryptProtectData\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1486","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1486","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"string-897","type":2,"relevance":1,"name":"Contains references to RC4 cryptographic API (string)","description":"Found reference to API \"SystemFunction032\" (Indicator: \"systemfunction032\"; Source: \"00000000-00007376.00000000.113264.72F31000.00000020.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")\n Found reference to API \"SystemFunction033\" (Indicator: \"systemfunction033\"; Source: \"00000000-00007376.00000000.113264.72F31000.00000020.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","description_v2":["Found reference to API \"SystemFunction032\" (Indicator: \"systemfunction032\"; Source: \"00000000-00007376.00000000.113264.72F31000.00000020.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"SystemFunction033\" (Indicator: \"systemfunction033\"; Source: \"00000000-00007376.00000000.113264.72F31000.00000020.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"SystemFunction032\" (Indicator: \"systemfunction032\"; Source: \"00000000-00007376.00000000.113264.72F31000.00000020.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SystemFunction033\" (Indicator: \"systemfunction033\"; Source: \"00000000-00007376.00000000.113264.72F31000.00000020.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"summary-32","type":15,"relevance":1,"name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - RC4 Encryption","description_v2":["The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]","Matched sigs: YARA signature match - RC4 Encryption"],"description_v3":[{"type":"text","value":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: YARA signature match - RC4 Encryption"}],"origin":"Indicator Combinations","attck_id":"T1140","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1140","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"summary-28","type":15,"relevance":1,"name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Able to utilize the Windows bcrypt cryptographic API\n Matched sigs: Contains ability to import cryptographic keys (seen in ransomware)\n Matched sigs: Contains references to RC4 cryptographic API (string)\n Matched sigs: References bcrypt module and functions (used for encryption/decryption)\n Matched sigs: Contains ability to encrypt/encode message (API string)\n Matched sigs: Contains ability to perform encryption (API string)\n Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to perform decryption (API string)\n Matched sigs: Able to access crypto-related API (String)\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - RC4 Encryption","description_v2":["The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings","Matched sigs: Contains ability to use Cryptographic classes","Matched sigs: Able to utilize the Windows bcrypt cryptographic API","Matched sigs: Contains ability to import cryptographic keys (seen in ransomware)","Matched sigs: Contains references to RC4 cryptographic API (string)","Matched sigs: References bcrypt module and functions (used for encryption/decryption)","Matched sigs: Contains ability to encrypt/encode message (API string)","Matched sigs: Contains ability to perform encryption (API string)","Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider","Matched sigs: Contains ability to perform decryption (API string)","Matched sigs: Able to access crypto-related API (String)","Matched sigs: Contains XOR operation loops [Stream disassembly]","Matched sigs: YARA signature match - RC4 Encryption"],"description_v3":[{"type":"text","value":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to use Cryptographic classes"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Able to utilize the Windows bcrypt cryptographic API"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to import cryptographic keys (seen in ransomware)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains references to RC4 cryptographic API (string)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: References bcrypt module and functions (used for encryption/decryption)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to encrypt/encode message (API string)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to perform encryption (API string)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to perform decryption (API string)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Able to access crypto-related API (String)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains XOR operation loops [Stream disassembly]"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: YARA signature match - RC4 Encryption"}],"origin":"Indicator Combinations","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"summary-31","type":15,"relevance":1,"name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - RC4 Encryption","description_v2":["The analysis shows use of encryption","use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","Matched sigs: YARA signature match - RC4 Encryption"],"description_v3":[{"type":"text","value":"The analysis shows use of encryption"},{"type":"linebreak"},{"type":"text","value":"use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: YARA signature match - RC4 Encryption"}],"origin":"Indicator Combinations","attck_id":"T1573.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1573/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-907","type":2,"relevance":1,"name":"Able to enumerate system processes using native API","description":"$4c","description_v2":["$4d","Found reference to API \"ZwQuerySystemInformation failed [%x]\" (Indicator: \"ZwQuerySystemInformation\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"$4e"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ZwQuerySystemInformation failed [%x]\" (Indicator: \"ZwQuerySystemInformation\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-902","type":2,"relevance":1,"name":"Able to gather system firmware table (API string)","description":"file/memory contains long string(Source: \"00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","description_v2":["file/memory contains long string(Source: \"00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"file/memory contains long string(Source: \"00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1592.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1592/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-937","type":2,"relevance":1,"name":"Able to gather system information (.NET)","description":"$4f","description_v2":["Found string \"SMBIOSBIOSVersion\" (Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp\")","Found string \"UserName\" (Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.746E1000.00000020.mdmp\")","Found string \"hook_GetUserNameExA\" (Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found string \"hook_GetUserNameExW\" (Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found string \"GetUserNameA\" (Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found string \"GetUserNameW\" (Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found string \"lpMachineName\" (Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found string \"GetUserNameExA\" (Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74741000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found string \"GetUserNameExW\" (Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.746E1000.00000020.mdmp, 00000000-00007376.00000000.113264.74741000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.77071000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found string \"OSVersion\" (Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp\")","Found string \"OSVersionEx\" (Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp\")","Found string \"DNSMachineName\" (Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp\")","Found string \"MachineName\" (Source: \"00000000-00007376.00000000.113264.7309D000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"SMBIOSBIOSVersion\" (Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"UserName\" (Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.746E1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"hook_GetUserNameExA\" (Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"hook_GetUserNameExW\" (Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"GetUserNameA\" (Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"GetUserNameW\" (Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"lpMachineName\" (Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"GetUserNameExA\" (Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74741000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"GetUserNameExW\" (Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.746E1000.00000020.mdmp, 00000000-00007376.00000000.113264.74741000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.77071000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"OSVersion\" (Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"OSVersionEx\" (Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"DNSMachineName\" (Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"MachineName\" (Source: \"00000000-00007376.00000000.113264.7309D000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-898","type":2,"relevance":1,"name":"Able to identify Internet Explorer version from registry","description":"Found string \"HKLM\\SOFTWARE\\Microsoft\\Internet Explorer\\Version Vector\" (Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","description_v2":["Found string \"HKLM\\SOFTWARE\\Microsoft\\Internet Explorer\\Version Vector\" (Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"HKLM\\SOFTWARE\\Microsoft\\Internet Explorer\\Version Vector\" (Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-666","type":2,"relevance":1,"name":"Able to identify sandbox environment running process","description":"Found string \"vboxservice.exe\" (Indicator: \"vboxservice.exe\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")\n Found string \"vboxtray.exe\" (Indicator: \"vboxtray.exe\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","description_v2":["Found string \"vboxservice.exe\" (Indicator: \"vboxservice.exe\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found string \"vboxtray.exe\" (Indicator: \"vboxtray.exe\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"vboxservice.exe\" (Indicator: \"vboxservice.exe\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"vboxtray.exe\" (Indicator: \"vboxtray.exe\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1497","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1497","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-658","type":2,"relevance":1,"name":"Able to identify virtual box environment","description":"Found string \"VBoxTrayToolWndClass\" (Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","description_v2":["Found string \"VBoxTrayToolWndClass\" (Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"VBoxTrayToolWndClass\" (Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1010","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1010","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-659","type":2,"relevance":1,"name":"Able to identify virtual environment by using API string","description":"$50","description_v2":["$51","Found string \"GetSystemFirmwareTable\" (Indicator: \"GetSystemFirmwareTable\"; Source: \"00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"$52"},{"type":"linebreak"},{"type":"text","value":"Found string \"GetSystemFirmwareTable\" (Indicator: \"GetSystemFirmwareTable\"; Source: \"00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1497.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1497/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-661","type":2,"relevance":1,"name":"Able to identify virtual environment by using user activity (API string)","description":"$53","description_v2":["Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found string \"GetLastInputInfo\" (Indicator: \"GetLastInputInfo\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"GetLastInputInfo\" (Indicator: \"GetLastInputInfo\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1497.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1497/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-663","type":2,"relevance":1,"name":"Able to identify virtual environment using user register activity","description":"Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")\n Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp\")","description_v2":["Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1497.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1497/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-660","type":2,"relevance":1,"name":"Able to identify virtual/sandbox environment","description":"$54","description_v2":["Found string \"vmhgfs\" (Indicator: \"vmhgfs\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found string \"vmmouse\" (Indicator: \"vmmouse\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found string \"vmusbmouse\" (Indicator: \"vmusb\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found string \"VMMemCtl\" (Indicator: \"vmmemctl\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found string \"vmusb\" (Indicator: \"vmusb\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found string \"vmx_svga\" (Indicator: \"vmx_svga\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found string \"vmxnet\" (Indicator: \"vmxnet\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found string \"vmx86\" (Indicator: \"vmx86\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found string \"VBoxGuest\" (Indicator: \"VBoxGuest\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found string \"VBoxMouse\" (Indicator: \"VBoxMouse\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found string \"VBoxSF\" (Indicator: \"VBoxSF\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found string \"VBoxWddm\" (Indicator: \"VBoxWddm\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found string \"VBoxMouse.sys\" (Indicator: \"VBoxMouse\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found string \"VBoxGuest.sys\" (Indicator: \"VBoxGuest\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found string \"VBoxSF.sys\" (Indicator: \"VBoxSF\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found string \"vmmouse.sys\" (Indicator: \"vmmouse\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found string \"vmusbmouse.sys\" (Indicator: \"vmusb\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found string \"vmmemctl.sys\" (Indicator: \"vmmemctl\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"vmhgfs\" (Indicator: \"vmhgfs\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"vmmouse\" (Indicator: \"vmmouse\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"vmusbmouse\" (Indicator: \"vmusb\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"VMMemCtl\" (Indicator: \"vmmemctl\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"vmusb\" (Indicator: \"vmusb\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"vmx_svga\" (Indicator: \"vmx_svga\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"vmxnet\" (Indicator: \"vmxnet\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"vmx86\" (Indicator: \"vmx86\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"VBoxGuest\" (Indicator: \"VBoxGuest\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"VBoxMouse\" (Indicator: \"VBoxMouse\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"VBoxSF\" (Indicator: \"VBoxSF\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"VBoxWddm\" (Indicator: \"VBoxWddm\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"VBoxMouse.sys\" (Indicator: \"VBoxMouse\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"VBoxGuest.sys\" (Indicator: \"VBoxGuest\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"VBoxSF.sys\" (Indicator: \"VBoxSF\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"vmmouse.sys\" (Indicator: \"vmmouse\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"vmusbmouse.sys\" (Indicator: \"vmusb\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"vmmemctl.sys\" (Indicator: \"vmmemctl\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1497.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1497/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-906","type":2,"relevance":1,"name":"Able to list processes on remote desktop session host","description":"$55","description_v2":["Found reference to API \"WTSOpenServerA\" (Indicator: \"WTSOpenServer\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"WTSOpenServerW\" (Indicator: \"WTSOpenServer\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"WTSOpenServerExA\" (Indicator: \"WTSOpenServer\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"WTSOpenServerExW\" (Indicator: \"WTSOpenServer\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"WTSEnumerateProcessesA\" (Indicator: \"WTSEnumerateProcesses\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"WTSEnumerateProcessesW\" (Indicator: \"WTSEnumerateProcesses\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"WTSEnumerateProcessesExA\" (Indicator: \"WTSEnumerateProcesses\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"WTSEnumerateProcessesExW\" (Indicator: \"WTSEnumerateProcesses\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"WTSOpenServerA\" (Indicator: \"WTSOpenServer\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WTSOpenServerW\" (Indicator: \"WTSOpenServer\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WTSOpenServerExA\" (Indicator: \"WTSOpenServer\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WTSOpenServerExW\" (Indicator: \"WTSOpenServer\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WTSEnumerateProcessesA\" (Indicator: \"WTSEnumerateProcesses\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WTSEnumerateProcessesW\" (Indicator: \"WTSEnumerateProcesses\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WTSEnumerateProcessesExA\" (Indicator: \"WTSEnumerateProcesses\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WTSEnumerateProcessesExW\" (Indicator: \"WTSEnumerateProcesses\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-908","type":2,"relevance":1,"name":"Able to query security token membership for user discovery (API string)","description":"$56","description_v2":["Found reference to API \"AllocateAndInitializeSid failed %d\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"CheckTokenMembership failed: %d\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"AllocateAndInitializeSid failed %d\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CheckTokenMembership failed: %d\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1033","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1033","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-910","type":2,"relevance":1,"name":"Able to query service configuration on system (API string)","description":"$57","description_v2":["Found string \"hook_EnumServicesStatusA\" (Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found string \"hook_EnumServicesStatusW\" (Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found string \"hook_EnumServicesStatusExA\" (Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found string \"hook_EnumServicesStatusExW\" (Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found string \"EnumServicesStatusA\" (Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp\")","Found string \"EnumServicesStatusW\" (Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found string \"EnumServicesStatusExA\" (Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found string \"EnumServicesStatusExW\" (Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found string \"QueryServiceStatusEx\" (Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found string \"QueryServiceConfigW\" (Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found string \"QueryServiceStatus\" (Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.74BC1000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"hook_EnumServicesStatusA\" (Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"hook_EnumServicesStatusW\" (Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"hook_EnumServicesStatusExA\" (Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"hook_EnumServicesStatusExW\" (Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"EnumServicesStatusA\" (Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"EnumServicesStatusW\" (Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"EnumServicesStatusExA\" (Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"EnumServicesStatusExW\" (Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"QueryServiceStatusEx\" (Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"QueryServiceConfigW\" (Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"QueryServiceStatus\" (Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.74BC1000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1007","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1007","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-201","type":2,"relevance":1,"name":"Able to query system locale information (API string)","description":"$58","description_v2":["Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.748D1000.00000020.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"EnumSystemLocalesEx\" (Indicator: \"EnumSystemLocales\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.748D1000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.748D1000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"EnumSystemLocalesW\" (Indicator: \"EnumSystemLocales\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"hook_GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"hook_GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.748D1000.00000020.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"EnumSystemLocalesEx\" (Indicator: \"EnumSystemLocales\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.748D1000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.748D1000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"EnumSystemLocalesW\" (Indicator: \"EnumSystemLocales\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"hook_GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"hook_GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1614","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1614","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-193","type":2,"relevance":1,"name":"Able to query volume/memory size (API string)","description":"$59","description_v2":["Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpaceEx\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GlobalMemoryStatus2GB\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_GlobalMemoryStatus2GB::APIHook_GlobalMemoryStatus\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_GlobalMemoryStatus2GB::InitializeHooksMulti\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"GlobalMemoryStatus\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpaceEx\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GlobalMemoryStatus2GB\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_GlobalMemoryStatus2GB::APIHook_GlobalMemoryStatus\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_GlobalMemoryStatus2GB::InitializeHooksMulti\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GlobalMemoryStatus\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-901","type":2,"relevance":1,"name":"Able to retrieve date formats supported by the local system (API string)","description":"$5a","description_v2":["Found reference to API \"GetDateFormatEx\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.748D1000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GetTimeFormatEx\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.748D1000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"EnumDateFormatsA\" (Indicator: \"EnumDateFormats\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"EnumDateFormatsExA\" (Indicator: \"EnumDateFormats\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"EnumDateFormatsExEx\" (Indicator: \"EnumDateFormats\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"EnumDateFormatsExW\" (Indicator: \"EnumDateFormats\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"EnumDateFormatsW\" (Indicator: \"EnumDateFormats\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetDateFormatEx\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.748D1000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTimeFormatEx\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.748D1000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"EnumDateFormatsA\" (Indicator: \"EnumDateFormats\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"EnumDateFormatsExA\" (Indicator: \"EnumDateFormats\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"EnumDateFormatsExEx\" (Indicator: \"EnumDateFormats\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"EnumDateFormatsExW\" (Indicator: \"EnumDateFormats\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"EnumDateFormatsW\" (Indicator: \"EnumDateFormats\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1124","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1124","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-739","type":2,"relevance":1,"name":"Able to retrieve geographical location information","description":"Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74BC1000.00000020.mdmp, 00000000-00007376.00000000.113264.76D71000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")\n Found reference to API \"GetUserGeoID\" (Indicator: \"getusergeoid\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")\n Found reference to API \"GetGeoInfoW\" (Indicator: \"getgeoinfo\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","description_v2":["Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74BC1000.00000020.mdmp, 00000000-00007376.00000000.113264.76D71000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GetUserGeoID\" (Indicator: \"getusergeoid\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GetGeoInfoW\" (Indicator: \"getgeoinfo\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74BC1000.00000020.mdmp, 00000000-00007376.00000000.113264.76D71000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetUserGeoID\" (Indicator: \"getusergeoid\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetGeoInfoW\" (Indicator: \"getgeoinfo\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-89","type":2,"relevance":1,"name":"Able to retrieve information about the current system (API string)","description":"$5b","description_v2":["$5c","Found system information discovery API: \"GetEnvironmentStringsW\" in \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\"","$5d","Found system information discovery API: \"ExpandEnvironmentStringsA\" in \"00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\"","$5e","Found system information discovery API: \"hook_GetNativeSystemInfo\" in \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\"","Found system information discovery API: \"hook_GetMonitorInfoA\" in \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\"","Found system information discovery API: \"hook_GetMonitorInfoW\" in \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\"","Found system information discovery API: \"GetNativeSystemInfo\" in \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\"","Found system information discovery API: \"GetMonitorInfoA\" in \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\"","Found system information discovery API: \"GetMonitorInfoW\" in \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\"","Found system information discovery API: \"WTSRegisterSessionNotification\" in \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\"","Found system information discovery API: \"WTSRegisterSessionNotificationEx\" in \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\"","Found system information discovery API: \"NS_EmulateEnvironmentBlock::APIHook_GetEnvironmentStringsA\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\"","Found system information discovery API: \"NS_EmulateEnvironmentBlock::APIHook_GetEnvironmentStringsW\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\"","Found system information discovery API: \"GetEnvironmentStrings\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\"","Found system information discovery API: \"GetEnvironmentStringsA\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\"","Found system information discovery API: \"NS_ProfilesEnvStrings::APIHook_ExpandEnvironmentStringsA\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\"","Found system information discovery API: \"NS_ProfilesEnvStrings::APIHook_ExpandEnvironmentStringsW\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\"","$5f","Found system information discovery API: \"[CreateFileA] ExpandEnvironmentStringsA failed\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\"","Found system information discovery API: \"ExpandEnvironmentStringsW failed\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\"","Found system information discovery API: \"GetUserObjectInformationW\" in \"00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74531000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.748D1000.00000020.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\"","Found system information discovery API: \"RtlGetNativeSystemInformation failed [%x]\" in \"00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp\"","Found system information discovery API: \"ZwQuerySystemInformation failed [%x]\" in \"00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp\""],"description_v3":[{"type":"text","value":"$60"},{"type":"linebreak"},{"type":"text","value":"Found system information discovery API: \"GetEnvironmentStringsW\" in \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\""},{"type":"linebreak"},{"type":"text","value":"$61"},{"type":"linebreak"},{"type":"text","value":"Found system information discovery API: \"ExpandEnvironmentStringsA\" in \"00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\""},{"type":"linebreak"},{"type":"text","value":"$62"},{"type":"linebreak"},{"type":"text","value":"Found system information discovery API: \"hook_GetNativeSystemInfo\" in \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found system information discovery API: \"hook_GetMonitorInfoA\" in \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found system information discovery API: \"hook_GetMonitorInfoW\" in \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found system information discovery API: \"GetNativeSystemInfo\" in \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found system information discovery API: \"GetMonitorInfoA\" in \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found system information discovery API: \"GetMonitorInfoW\" in \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found system information discovery API: \"WTSRegisterSessionNotification\" in \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found system information discovery API: \"WTSRegisterSessionNotificationEx\" in \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found system information discovery API: \"NS_EmulateEnvironmentBlock::APIHook_GetEnvironmentStringsA\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found system information discovery API: \"NS_EmulateEnvironmentBlock::APIHook_GetEnvironmentStringsW\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found system information discovery API: \"GetEnvironmentStrings\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found system information discovery API: \"GetEnvironmentStringsA\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found system information discovery API: \"NS_ProfilesEnvStrings::APIHook_ExpandEnvironmentStringsA\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found system information discovery API: \"NS_ProfilesEnvStrings::APIHook_ExpandEnvironmentStringsW\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\""},{"type":"linebreak"},{"type":"text","value":"$63"},{"type":"linebreak"},{"type":"text","value":"Found system information discovery API: \"[CreateFileA] ExpandEnvironmentStringsA failed\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found system information discovery API: \"ExpandEnvironmentStringsW failed\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found system information discovery API: \"GetUserObjectInformationW\" in \"00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74531000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.748D1000.00000020.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found system information discovery API: \"RtlGetNativeSystemInformation failed [%x]\" in \"00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found system information discovery API: \"ZwQuerySystemInformation failed [%x]\" in \"00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp\""}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-143","type":2,"relevance":1,"name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetSystemDefaultLangID\" (Indicator: \"GetSystemDefaultLangID\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","description_v2":["Found reference to API \"GetSystemDefaultLangID\" (Indicator: \"GetSystemDefaultLangID\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetSystemDefaultLangID\" (Indicator: \"GetSystemDefaultLangID\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1614.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1614/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-737","type":2,"relevance":1,"name":"Able to retrieve the current system language","description":"Found reference to API \"NtQueryDefaultUILanguage\" (Indicator: \"ntquerydefaultuilanguage\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")\n Found reference to API \"NtQueryInstallUILanguage\" (Indicator: \"ntqueryinstalluilanguage\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")","description_v2":["Found reference to API \"NtQueryDefaultUILanguage\" (Indicator: \"ntquerydefaultuilanguage\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")","Found reference to API \"NtQueryInstallUILanguage\" (Indicator: \"ntqueryinstalluilanguage\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"NtQueryDefaultUILanguage\" (Indicator: \"ntquerydefaultuilanguage\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NtQueryInstallUILanguage\" (Indicator: \"ntqueryinstalluilanguage\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1614.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1614/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-743","type":2,"relevance":1,"name":"Able to retrieve the local machine's name","description":"Found reference to API \"hook_GetComputerObjectNameA\" (Indicator: \"getcomputerobjectname\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")\n Found reference to API \"hook_GetComputerObjectNameW\" (Indicator: \"getcomputerobjectname\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")\n Found reference to API \"GetComputerObjectNameA\" (Indicator: \"getcomputerobjectname\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")\n Found reference to API \"GetComputerObjectNameW\" (Indicator: \"getcomputerobjectname\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","description_v2":["Found reference to API \"hook_GetComputerObjectNameA\" (Indicator: \"getcomputerobjectname\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"hook_GetComputerObjectNameW\" (Indicator: \"getcomputerobjectname\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"GetComputerObjectNameA\" (Indicator: \"getcomputerobjectname\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GetComputerObjectNameW\" (Indicator: \"getcomputerobjectname\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"hook_GetComputerObjectNameA\" (Indicator: \"getcomputerobjectname\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"hook_GetComputerObjectNameW\" (Indicator: \"getcomputerobjectname\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetComputerObjectNameA\" (Indicator: \"getcomputerobjectname\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetComputerObjectNameW\" (Indicator: \"getcomputerobjectname\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-721","type":2,"relevance":1,"name":"Able to visualize and control listed components (API string)","description":"$64","description_v2":["Found reference to API \"FilterSendMessage\" (Indicator: \"sendmessage\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74431000.00000020.mdmp\")","Found reference to API \"hook_NtUserFindWindowEx\" (Indicator: \"findwindow\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"hook_EnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"FindWindowA\" (Indicator: \"findwindow\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"FindWindowExA\" (Indicator: \"findwindow\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp\")","Found reference to API \"FindWindowExW\" (Indicator: \"findwindow\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"FindWindowW\" (Indicator: \"findwindow\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.76501000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"SendMessage\" (Indicator: \"sendmessage\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"NtUserFindWindowEx\" (Indicator: \"findwindow\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.778D1000.00000020.mdmp\")","Found reference to API \"EnumChildWindows\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; Source: \"00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.74BC1000.00000020.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.76501000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; Source: \"00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"SendMessageTimeoutW\" (Indicator: \"sendmessage\"; Source: \"00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"DWM8And16Bit_EnumWindowsCallBack\" (Indicator: \"enumwindows\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"FilterSendMessage\" (Indicator: \"sendmessage\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74431000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"hook_NtUserFindWindowEx\" (Indicator: \"findwindow\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"hook_EnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindWindowA\" (Indicator: \"findwindow\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindWindowExA\" (Indicator: \"findwindow\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindWindowExW\" (Indicator: \"findwindow\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindWindowW\" (Indicator: \"findwindow\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.76501000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SendMessage\" (Indicator: \"sendmessage\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NtUserFindWindowEx\" (Indicator: \"findwindow\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.778D1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"EnumChildWindows\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; Source: \"00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.74BC1000.00000020.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.76501000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; Source: \"00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SendMessageTimeoutW\" (Indicator: \"sendmessage\"; Source: \"00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"DWM8And16Bit_EnumWindowsCallBack\" (Indicator: \"enumwindows\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1055.015","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1055/015","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-297","type":6,"relevance":3,"name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"regsvr32.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00007376)","description_v2":["\"regsvr32.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00007376)"],"description_v3":[{"type":"text","value":"\"regsvr32.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00007376)"}],"origin":"API Call","attck_id":"T1003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-125","type":6,"relevance":3,"name":"Calls an API typically used to get system version information","description":"\"regsvr32.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007376)","description_v2":["\"regsvr32.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007376)"],"description_v3":[{"type":"text","value":"\"regsvr32.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007376)"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"stream-87","type":1,"relevance":3,"name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNELBASE.DLL at 00000000-00007376-36839-31-00D23663","description_v2":["GetTickCount@KERNELBASE.DLL at 00000000-00007376-36839-31-00D23663"],"description_v3":[{"type":"text","value":"GetTickCount@KERNELBASE.DLL"},{"type":"stream","stream_uid":"00000000-00007376-36839-31-00D23663","modal_link":"/bff/report/68b8504446b83fb2480c50bd/processes/00000000-00007376/streams/0/00000000-00007376-36839-31-00D23663","process":{"name":"regsvr32.exe","process_uid":"00000000-00007376","pid":"7376"}}],"origin":"Hybrid Analysis Technology","attck_id":"T1497","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1497","stream_data":{"modal_link":"/bff/report/68b8504446b83fb2480c50bd/processes/00000000-00007376/streams/0/00000000-00007376-36839-31-00D23663","name":"regsvr32.exe","pid":7376}},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-450","type":2,"relevance":1,"name":"Contains ability to determine if process is running under WOW64 (API string)","description":"$65","description_v2":["Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"hook_IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"hook_IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-194","type":2,"relevance":1,"name":"Contains ability to enumerate volumes (API string)","description":"Found reference to API \"GetVolumePathNamesForVolumeNameW\" (Indicator: \"GetVolumePathNamesForVolumeName\"; Source: \"00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")\n Found reference to API \"GetVolumePathNamesForVolumeNameW\" (Indicator: \"GetVolumePathName\"; Source: \"00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","description_v2":["Found reference to API \"GetVolumePathNamesForVolumeNameW\" (Indicator: \"GetVolumePathNamesForVolumeName\"; Source: \"00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GetVolumePathNamesForVolumeNameW\" (Indicator: \"GetVolumePathName\"; Source: \"00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetVolumePathNamesForVolumeNameW\" (Indicator: \"GetVolumePathNamesForVolumeName\"; Source: \"00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetVolumePathNamesForVolumeNameW\" (Indicator: \"GetVolumePathName\"; Source: \"00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1006","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1006","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-433","type":2,"relevance":1,"name":"Contains ability to execute a WMI query","description":"$66","description_v2":["Found string \"SELECT * FROM MSACPI_THERMALZONETEMPERATURE\" (Indicator: \"select * from \"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp\")","Found string \"SELECT * FROM WIN32_FAN\" (Indicator: \"select * from \"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp\")","Found string \"SELECT * FROM WIN32_CACHEMEMORY\" (Indicator: \"select * from \"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp\")","Found string \"SELECT * FROM WIN32_PHYSICALMEMORY\" (Indicator: \"select * from \"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp\")","Found string \"SELECT * FROM WIN32_MEMORYDEVICE\" (Indicator: \"select * from \"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp\")","Found string \"SELECT * FROM WIN32_MEMORYARRAY\" (Indicator: \"select * from \"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp\")","Found string \"SELECT * FROM WIN32_VOLTAGEPROBE\" (Indicator: \"select * from \"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp\")","Found string \"SELECT * FROM WIN32_PORTCONNECTOR\" (Indicator: \"select * from \"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp\")","Found string \"SELECT * FROM WIN32_SMBIOSMEMORY\" (Indicator: \"select * from \"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp\")","Found string \"SELECT * FROM WIN32_PERFFORMATTEDDATA_COUNTERS_THERMALZONEINFORMATION\" (Indicator: \"select * from \"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp\")","Found string \"SELECT * FROM CIM_MEMORY\" (Indicator: \"select * from \"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp\")","Found string \"SELECT * FROM CIM_NUMERICSENSOR\" (Indicator: \"select * from \"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp\")","Found string \"SELECT * FROM CIM_PHYSICALCONNECTOR\" (Indicator: \"select * from \"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp\")","Found string \"SELECT * FROM CIM_SENSOR\" (Indicator: \"select * from \"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp\")","Found string \"SELECT * FROM CIM_SLOT\" (Indicator: \"select * from \"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp\")","Found string \"SELECT * FROM CIM_TEMPERATURESENSOR\" (Indicator: \"select * from \"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp\")","Found string \"SELECT * FROM CIM_VOLTAGESENSOR\" (Indicator: \"select * from \"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"SELECT * FROM MSACPI_THERMALZONETEMPERATURE\" (Indicator: \"select * from \"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"SELECT * FROM WIN32_FAN\" (Indicator: \"select * from \"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"SELECT * FROM WIN32_CACHEMEMORY\" (Indicator: \"select * from \"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"SELECT * FROM WIN32_PHYSICALMEMORY\" (Indicator: \"select * from \"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"SELECT * FROM WIN32_MEMORYDEVICE\" (Indicator: \"select * from \"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"SELECT * FROM WIN32_MEMORYARRAY\" (Indicator: \"select * from \"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"SELECT * FROM WIN32_VOLTAGEPROBE\" (Indicator: \"select * from \"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"SELECT * FROM WIN32_PORTCONNECTOR\" (Indicator: \"select * from \"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"SELECT * FROM WIN32_SMBIOSMEMORY\" (Indicator: \"select * from \"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"SELECT * FROM WIN32_PERFFORMATTEDDATA_COUNTERS_THERMALZONEINFORMATION\" (Indicator: \"select * from \"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"SELECT * FROM CIM_MEMORY\" (Indicator: \"select * from \"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"SELECT * FROM CIM_NUMERICSENSOR\" (Indicator: \"select * from \"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"SELECT * FROM CIM_PHYSICALCONNECTOR\" (Indicator: \"select * from \"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"SELECT * FROM CIM_SENSOR\" (Indicator: \"select * from \"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"SELECT * FROM CIM_SLOT\" (Indicator: \"select * from \"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"SELECT * FROM CIM_TEMPERATURESENSOR\" (Indicator: \"select * from \"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"SELECT * FROM CIM_VOLTAGESENSOR\" (Indicator: \"select * from \"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1047","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1047","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-413","type":2,"relevance":1,"name":"Contains ability to find open windows (API string)","description":"$67","description_v2":["Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"FindWindowExA\" (Indicator: \"FindWindowExA\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp\")","Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.76501000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindWindowExA\" (Indicator: \"FindWindowExA\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.76501000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1010","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1010","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-365","type":2,"relevance":1,"name":"Contains ability to perform scheduled transfer (API string)","description":"$68","description_v2":["$69","Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.748D1000.00000020.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"$6a"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.748D1000.00000020.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1029","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1029","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"stream-71","type":1,"relevance":1,"name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNELBASE.DLL at 00000000-00007376-36839-31-00D23663","description_v2":["GetSystemTimeAsFileTime@KERNELBASE.DLL at 00000000-00007376-36839-31-00D23663"],"description_v3":[{"type":"text","value":"GetSystemTimeAsFileTime@KERNELBASE.DLL"},{"type":"stream","stream_uid":"00000000-00007376-36839-31-00D23663","modal_link":"/bff/report/68b8504446b83fb2480c50bd/processes/00000000-00007376/streams/0/00000000-00007376-36839-31-00D23663","process":{"name":"regsvr32.exe","process_uid":"00000000-00007376","pid":"7376"}}],"origin":"Hybrid Analysis Technology","attck_id":"T1070.006","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1070/006","stream_data":{"modal_link":"/bff/report/68b8504446b83fb2480c50bd/processes/00000000-00007376/streams/0/00000000-00007376-36839-31-00D23663","name":"regsvr32.exe","pid":7376}},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"stream-2","type":1,"relevance":1,"name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNELBASE.DLL at 00000000-00007376-36839-31-00D23663","description_v2":["GetSystemTimeAsFileTime@KERNELBASE.DLL at 00000000-00007376-36839-31-00D23663"],"description_v3":[{"type":"text","value":"GetSystemTimeAsFileTime@KERNELBASE.DLL"},{"type":"stream","stream_uid":"00000000-00007376-36839-31-00D23663","modal_link":"/bff/report/68b8504446b83fb2480c50bd/processes/00000000-00007376/streams/0/00000000-00007376-36839-31-00D23663","process":{"name":"regsvr32.exe","process_uid":"00000000-00007376","pid":"7376"}}],"origin":"Hybrid Analysis Technology","attck_id":"T1124","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1124","stream_data":{"modal_link":"/bff/report/68b8504446b83fb2480c50bd/processes/00000000-00007376/streams/0/00000000-00007376-36839-31-00D23663","name":"regsvr32.exe","pid":7376}},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"registry-78","type":3,"relevance":1,"name":"Contains ability to read software policies","description":"\"regsvr32.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","description_v2":["\"regsvr32.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")"],"description_v3":[{"type":"text","value":"\"regsvr32.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")"}],"origin":"Registry Access","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-451","type":2,"relevance":1,"name":"Contains ability to retrieve configuration of a workstation (API string)","description":"Found reference to API \"hook_NetWkstaGetInfo\" (Indicator: \"NetWkstaGetInfo\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")\n Found reference to API \"NetWkstaGetInfo\" (Indicator: \"NetWkstaGetInfo\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","description_v2":["Found reference to API \"hook_NetWkstaGetInfo\" (Indicator: \"NetWkstaGetInfo\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"NetWkstaGetInfo\" (Indicator: \"NetWkstaGetInfo\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"hook_NetWkstaGetInfo\" (Indicator: \"NetWkstaGetInfo\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NetWkstaGetInfo\" (Indicator: \"NetWkstaGetInfo\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1016","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1016","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-249","type":2,"relevance":1,"name":"Contains ability to retrieve file time (API string)","description":"$6b","description_v2":["$6c","Found reference to API \"FileTimeToLocalFileTime\" (Indicator: \"FileTimeToLocalFileTime\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GetFileTime\" (Indicator: \"GetFileTime\"; Source: \"00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; Source: \"00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"$6d"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FileTimeToLocalFileTime\" (Indicator: \"FileTimeToLocalFileTime\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileTime\" (Indicator: \"GetFileTime\"; Source: \"00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; Source: \"00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1070.006","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1070/006","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-533","type":2,"relevance":1,"name":"Contains ability to retrieve information set for devices (API string)","description":"$6e","description_v2":["Found reference to API \"SetupDiGetClassDevsA\" (Indicator: \"SetupDiGetClassDevs\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"SetupDiGetClassDevsW\" (Indicator: \"SetupDiGetClassDevs\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74D81000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"SetupDiEnumDeviceInfo\" (Indicator: \"SetupDiEnumDeviceInfo\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"SetupDiGetDeviceRegistryPropertyA\" (Indicator: \"SetupDiGetDeviceRegistryProperty\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp\")","Found reference to API \"SetupDiGetDeviceRegistryPropertyW\" (Indicator: \"SetupDiGetDeviceRegistryProperty\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"SetupDiGetClassDevsA\" (Indicator: \"SetupDiGetClassDevs\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetupDiGetClassDevsW\" (Indicator: \"SetupDiGetClassDevs\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74D81000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetupDiEnumDeviceInfo\" (Indicator: \"SetupDiEnumDeviceInfo\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetupDiGetDeviceRegistryPropertyA\" (Indicator: \"SetupDiGetDeviceRegistryProperty\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetupDiGetDeviceRegistryPropertyW\" (Indicator: \"SetupDiGetDeviceRegistryProperty\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1480","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1480","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-247","type":2,"relevance":1,"name":"Contains ability to retrieve machine time (API string)","description":"$6f","description_v2":["$70","Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.748D1000.00000020.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"$71"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.748D1000.00000020.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1124","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1124","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-222","type":2,"relevance":1,"name":"Contains ability to retrieve network parameters of a computer (API string)","description":"Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.746E1000.00000020.mdmp, 00000000-00007376.00000000.113264.76501000.00000020.mdmp, 00000000-00007376.00000000.113264.76E61000.00000020.mdmp, 00000000-00007376.00000000.113264.777D1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","description_v2":["Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.746E1000.00000020.mdmp, 00000000-00007376.00000000.113264.76501000.00000020.mdmp, 00000000-00007376.00000000.113264.76E61000.00000020.mdmp, 00000000-00007376.00000000.113264.777D1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.746E1000.00000020.mdmp, 00000000-00007376.00000000.113264.76501000.00000020.mdmp, 00000000-00007376.00000000.113264.76E61000.00000020.mdmp, 00000000-00007376.00000000.113264.777D1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1016","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1016","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-141","type":2,"relevance":1,"name":"Contains ability to retrieve open application windows (API string)","description":"$72","description_v2":["Found reference to API \"hook_NtUserFindWindowEx\" (Indicator: \"FindWindow\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"hook_GetWindowTextA\" (Indicator: \"GetWindowText\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"hook_GetWindowTextW\" (Indicator: \"GetWindowText\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"hook_EnumWindows\" (Indicator: \"EnumWindows\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"FindWindowA\" (Indicator: \"FindWindow\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"FindWindowExA\" (Indicator: \"FindWindow\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp\")","Found reference to API \"FindWindowExW\" (Indicator: \"FindWindow\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"FindWindowW\" (Indicator: \"FindWindow\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.76501000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.76501000.00000020.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.74531000.00000020.mdmp, 00000000-00007376.00000000.113264.748D1000.00000020.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GetWindowTextA\" (Indicator: \"GetWindowText\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GetWindowTextW\" (Indicator: \"GetWindowText\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"EnumWindows\" (Indicator: \"EnumWindows\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"NtUserFindWindowEx\" (Indicator: \"FindWindow\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.778D1000.00000020.mdmp\")","Found reference to API \"EnumDesktopsW\" (Indicator: \"EnumDesktops\"; Source: \"00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp\")","Found reference to API \"InternalGetWindowText\" (Indicator: \"GetWindowText\"; Source: \"00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"DWM8And16Bit_EnumWindowsCallBack\" (Indicator: \"EnumWindows\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"hook_NtUserFindWindowEx\" (Indicator: \"FindWindow\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"hook_GetWindowTextA\" (Indicator: \"GetWindowText\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"hook_GetWindowTextW\" (Indicator: \"GetWindowText\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"hook_EnumWindows\" (Indicator: \"EnumWindows\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindWindowA\" (Indicator: \"FindWindow\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindWindowExA\" (Indicator: \"FindWindow\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindow\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindWindowW\" (Indicator: \"FindWindow\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.76501000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.76501000.00000020.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.74531000.00000020.mdmp, 00000000-00007376.00000000.113264.748D1000.00000020.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetWindowTextA\" (Indicator: \"GetWindowText\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetWindowTextW\" (Indicator: \"GetWindowText\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"EnumWindows\" (Indicator: \"EnumWindows\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NtUserFindWindowEx\" (Indicator: \"FindWindow\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.778D1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"EnumDesktopsW\" (Indicator: \"EnumDesktops\"; Source: \"00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"InternalGetWindowText\" (Indicator: \"GetWindowText\"; Source: \"00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"DWM8And16Bit_EnumWindowsCallBack\" (Indicator: \"EnumWindows\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1010","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1010","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-312","type":2,"relevance":1,"name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","description_v2":["Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-171","type":2,"relevance":1,"name":"Contains ability to retrieve the OS information (API string)","description":"$73","description_v2":["Found reference to API \"RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")","Found reference to API \"hook_RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"Exception in hook_RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"VerifyVersionInfoLite\" (Indicator: \"VerifyVersionInfo\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"NS_FaultTolerantHeap::FthGetVersionString\" (Indicator: \"GetVersion\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_ForceDXSetupSuccess::DirectXSetupGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_VerifyVersionInfoLite::APIHook_VerifyVersionInfoA\" (Indicator: \"VerifyVersionInfo\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_VerifyVersionInfoLite::APIHook_VerifyVersionInfoW\" (Indicator: \"VerifyVersionInfo\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_VerifyVersionInfoLite::InitializeHooksMulti\" (Indicator: \"VerifyVersionInfo\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"VerifyVersionInfoA\" (Indicator: \"VerifyVersionInfo\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"VerifyVersionInfoW\" (Indicator: \"VerifyVersionInfo\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"NS_VistaRTMVersionLie::APIHook_GetVersionExA\" (Indicator: \"GetVersionExA\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_VistaRTMVersionLie::APIHook_GetVersionExA\" (Indicator: \"GetVersion\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_VistaRTMVersionLie::APIHook_GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_VistaRTMVersionLie::APIHook_GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_VistaRTMVersionLie::APIHook_GetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_VistaRTMVersionLie::APIHook_RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_VistaSP1VersionLie::APIHook_GetVersionExA\" (Indicator: \"GetVersionExA\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_VistaSP1VersionLie::APIHook_GetVersionExA\" (Indicator: \"GetVersion\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_VistaSP1VersionLie::APIHook_GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_VistaSP1VersionLie::APIHook_GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_VistaSP1VersionLie::APIHook_GetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_VistaSP1VersionLie::APIHook_RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_VistaSP2VersionLie::APIHook_GetVersionExA\" (Indicator: \"GetVersionExA\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_VistaSP2VersionLie::APIHook_GetVersionExA\" (Indicator: \"GetVersion\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_VistaSP2VersionLie::APIHook_GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_VistaSP2VersionLie::APIHook_GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_VistaSP2VersionLie::APIHook_GetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"hook_RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Exception in hook_RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"VerifyVersionInfoLite\" (Indicator: \"VerifyVersionInfo\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_FaultTolerantHeap::FthGetVersionString\" (Indicator: \"GetVersion\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_ForceDXSetupSuccess::DirectXSetupGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_VerifyVersionInfoLite::APIHook_VerifyVersionInfoA\" (Indicator: \"VerifyVersionInfo\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_VerifyVersionInfoLite::APIHook_VerifyVersionInfoW\" (Indicator: \"VerifyVersionInfo\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_VerifyVersionInfoLite::InitializeHooksMulti\" (Indicator: \"VerifyVersionInfo\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"VerifyVersionInfoA\" (Indicator: \"VerifyVersionInfo\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"VerifyVersionInfoW\" (Indicator: \"VerifyVersionInfo\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_VistaRTMVersionLie::APIHook_GetVersionExA\" (Indicator: \"GetVersionExA\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_VistaRTMVersionLie::APIHook_GetVersionExA\" (Indicator: \"GetVersion\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_VistaRTMVersionLie::APIHook_GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_VistaRTMVersionLie::APIHook_GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_VistaRTMVersionLie::APIHook_GetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_VistaRTMVersionLie::APIHook_RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_VistaSP1VersionLie::APIHook_GetVersionExA\" (Indicator: \"GetVersionExA\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_VistaSP1VersionLie::APIHook_GetVersionExA\" (Indicator: \"GetVersion\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_VistaSP1VersionLie::APIHook_GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_VistaSP1VersionLie::APIHook_GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_VistaSP1VersionLie::APIHook_GetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_VistaSP1VersionLie::APIHook_RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_VistaSP2VersionLie::APIHook_GetVersionExA\" (Indicator: \"GetVersionExA\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_VistaSP2VersionLie::APIHook_GetVersionExA\" (Indicator: \"GetVersion\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_VistaSP2VersionLie::APIHook_GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_VistaSP2VersionLie::APIHook_GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_VistaSP2VersionLie::APIHook_GetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-162","type":2,"relevance":1,"name":"Contains ability to retrieve volume information (API string)","description":"$74","description_v2":["Found reference to API \"NtQueryVolumeInformationFile\" (Indicator: \"NtQueryVolumeInformationFile\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")","Found reference to API \"GetVolumeNameForVolumeMountPointW\" (Indicator: \"GetVolumeNameForVolumeMountPoint\"; Source: \"00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GetVolumePathNamesForVolumeNameW\" (Indicator: \"GetVolumePathNamesForVolumeName\"; Source: \"00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"NtQueryVolumeInformationFile\" (Indicator: \"NtQueryVolumeInformationFile\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetVolumeNameForVolumeMountPointW\" (Indicator: \"GetVolumeNameForVolumeMountPoint\"; Source: \"00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetVolumePathNamesForVolumeNameW\" (Indicator: \"GetVolumePathNamesForVolumeName\"; Source: \"00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"stream-31","type":1,"relevance":1,"name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@KERNELBASE.DLL at 00000000-00007376-36839-53-00D22C5A","description_v2":["GetProcessHeap@KERNELBASE.DLL at 00000000-00007376-36839-53-00D22C5A"],"description_v3":[{"type":"text","value":"GetProcessHeap@KERNELBASE.DLL"},{"type":"stream","stream_uid":"00000000-00007376-36839-53-00D22C5A","modal_link":"/bff/report/68b8504446b83fb2480c50bd/processes/00000000-00007376/streams/0/00000000-00007376-36839-53-00D22C5A","process":{"name":"regsvr32.exe","process_uid":"00000000-00007376","pid":"7376"}}],"origin":"Hybrid Analysis Technology","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":{"modal_link":"/bff/report/68b8504446b83fb2480c50bd/processes/00000000-00007376/streams/0/00000000-00007376-36839-53-00D22C5A","name":"regsvr32.exe","pid":7376}},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-307","type":2,"relevance":1,"name":"Able to create/load registry keys (API string)","description":"$75","description_v2":["Found registry modification API: \"\" in \"00000000-00007376.00000000.113264.00680000.00000004.mdmp\"","Found registry modification API: \"\" in \"00000000-00007376.00000000.113264.00680000.00000004.mdmp\"","Found registry modification API: \"\" in \"00000000-00007376.00000000.113264.00680000.00000004.mdmp\"","Found registry modification API: \"\" in \"00000000-00007376.00000000.113264.00680000.00000004.mdmp\"","Found registry modification API: \"RegCreateKeyExA\" in \"00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\"","$76","Found registry modification API: \"RegCreateKeyExW: wrp key is mitigated\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\"","Found registry modification API: \"RegCreateKeyW: wrp key is mitigated\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\"","Found registry modification API: \"RegCreateKey: wrp key subkey mitigated\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\"","Found registry modification API: \"RegCreateKey: non-COM wrp subkey is not mitigated\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\"","Found registry modification API: \"RegCreateKeyA: wrp key is mitigated\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\"","Found registry modification API: \"RegCreateKeyExA: wrp key is mitigated\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\"","Found registry modification API: \"RegCreateKeyA\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\"","Found registry modification API: \"RegCreateKeyW\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.777D1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\"","Found registry modification API: \"RegConnectRegistryA\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\"","Found registry modification API: \"RegConnectRegistryW\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\"","Found registry modification API: \"NS_ProfilesRegQueryValueEx::APIHook_RegCreateKeyA\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\"","Found registry modification API: \"NS_ProfilesRegQueryValueEx::APIHook_RegCreateKeyW\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\"","Found registry modification API: \"NS_ProfilesRegQueryValueEx::APIHook_RegCreateKeyExA\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\"","Found registry modification API: \"NS_ProfilesRegQueryValueEx::APIHook_RegCreateKeyExW\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\"","Found registry modification API: \"RegCreateKey getting accedd denied on [%s]\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\"","Found registry modification API: \"NS_WRPMitigation::APIHook_RegCreateKeyA\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\""],"description_v3":[{"type":"text","value":"Found registry modification API: \"\" in \"00000000-00007376.00000000.113264.00680000.00000004.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found registry modification API: \"\" in \"00000000-00007376.00000000.113264.00680000.00000004.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found registry modification API: \"\" in \"00000000-00007376.00000000.113264.00680000.00000004.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found registry modification API: \"\" in \"00000000-00007376.00000000.113264.00680000.00000004.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found registry modification API: \"RegCreateKeyExA\" in \"00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\""},{"type":"linebreak"},{"type":"text","value":"$77"},{"type":"linebreak"},{"type":"text","value":"Found registry modification API: \"RegCreateKeyExW: wrp key is mitigated\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found registry modification API: \"RegCreateKeyW: wrp key is mitigated\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found registry modification API: \"RegCreateKey: wrp key subkey mitigated\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found registry modification API: \"RegCreateKey: non-COM wrp subkey is not mitigated\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found registry modification API: \"RegCreateKeyA: wrp key is mitigated\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found registry modification API: \"RegCreateKeyExA: wrp key is mitigated\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found registry modification API: \"RegCreateKeyA\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found registry modification API: \"RegCreateKeyW\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.777D1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found registry modification API: \"RegConnectRegistryA\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found registry modification API: \"RegConnectRegistryW\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found registry modification API: \"NS_ProfilesRegQueryValueEx::APIHook_RegCreateKeyA\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found registry modification API: \"NS_ProfilesRegQueryValueEx::APIHook_RegCreateKeyW\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found registry modification API: \"NS_ProfilesRegQueryValueEx::APIHook_RegCreateKeyExA\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found registry modification API: \"NS_ProfilesRegQueryValueEx::APIHook_RegCreateKeyExW\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found registry modification API: \"RegCreateKey getting accedd denied on [%s]\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found registry modification API: \"NS_WRPMitigation::APIHook_RegCreateKeyA\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\""}],"origin":"File/Memory","attck_id":"T1112","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1112","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-191","type":2,"relevance":1,"name":"Able to enumerate service (API string)","description":"$78","description_v2":["Found reference to API \"hook_OpenSCManagerA\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"hook_OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"hook_EnumServicesStatusA\" (Indicator: \"EnumServicesStatus\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"hook_EnumServicesStatusW\" (Indicator: \"EnumServicesStatus\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"hook_EnumServicesStatusExA\" (Indicator: \"EnumServicesStatus\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"hook_EnumServicesStatusExW\" (Indicator: \"EnumServicesStatus\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"OpenSCManagerA\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.74BC1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"EnumServicesStatusA\" (Indicator: \"EnumServicesStatus\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp\")","Found reference to API \"EnumServicesStatusW\" (Indicator: \"EnumServicesStatus\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"EnumServicesStatusExA\" (Indicator: \"EnumServicesStatus\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"EnumServicesStatusExW\" (Indicator: \"EnumServicesStatus\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"QueryServiceStatusEx\" (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.74BC1000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"hook_OpenSCManagerA\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"hook_OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"hook_EnumServicesStatusA\" (Indicator: \"EnumServicesStatus\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"hook_EnumServicesStatusW\" (Indicator: \"EnumServicesStatus\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"hook_EnumServicesStatusExA\" (Indicator: \"EnumServicesStatus\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"hook_EnumServicesStatusExW\" (Indicator: \"EnumServicesStatus\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"OpenSCManagerA\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.74BC1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"EnumServicesStatusA\" (Indicator: \"EnumServicesStatus\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"EnumServicesStatusW\" (Indicator: \"EnumServicesStatus\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"EnumServicesStatusExA\" (Indicator: \"EnumServicesStatus\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"EnumServicesStatusExW\" (Indicator: \"EnumServicesStatus\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"QueryServiceStatusEx\" (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.74BC1000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1007","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1007","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-884","type":2,"relevance":1,"name":"Able to rename or move file/directory (API string)","description":"$79","description_v2":["Found string \"\" (Indicator: \"MoveFileA\"; Source: \"00000000-00007376.00000000.113264.00680000.00000004.mdmp\")","Found string \"\" (Indicator: \"MoveFileW\"; Source: \"00000000-00007376.00000000.113264.00680000.00000004.mdmp\")","Found string \"\" (Indicator: \"MoveFileExA\"; Source: \"00000000-00007376.00000000.113264.00680000.00000004.mdmp\")","Found string \"\" (Indicator: \"MoveFileExW\"; Source: \"00000000-00007376.00000000.113264.00680000.00000004.mdmp\")","Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74531000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74531000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found string \"MoveFileExA\" (Indicator: \"MoveFileExA\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found string \"NS_MoveToCopyFileShim::APIHook_MoveFileA\" (Indicator: \"MoveFileA\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found string \"[MoveFileA] DeleteFileA failed\" (Indicator: \"MoveFileA\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found string \"NS_MoveToCopyFileShim::APIHook_MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found string \"[MoveFileW] DeleteFileW failed\" (Indicator: \"MoveFileW\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"\" (Indicator: \"MoveFileA\"; Source: \"00000000-00007376.00000000.113264.00680000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"\" (Indicator: \"MoveFileW\"; Source: \"00000000-00007376.00000000.113264.00680000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"\" (Indicator: \"MoveFileExA\"; Source: \"00000000-00007376.00000000.113264.00680000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"\" (Indicator: \"MoveFileExW\"; Source: \"00000000-00007376.00000000.113264.00680000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74531000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74531000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"MoveFileExA\" (Indicator: \"MoveFileExA\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"NS_MoveToCopyFileShim::APIHook_MoveFileA\" (Indicator: \"MoveFileA\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"[MoveFileA] DeleteFileA failed\" (Indicator: \"MoveFileA\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"NS_MoveToCopyFileShim::APIHook_MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"[MoveFileW] DeleteFileW failed\" (Indicator: \"MoveFileW\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-930","type":2,"relevance":1,"name":"Able to retrieve command line parameters of the running process","description":"$7a","description_v2":["Found string \"GetCommandLineW\" (Source: \"00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found string \"GetCommandLineA\" (Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"GetCommandLineW\" (Source: \"00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"GetCommandLineA\" (Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1059.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1059/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-900","type":2,"relevance":1,"name":"Able to use GrayString API for text rendering","description":"Found reference to API \"GrayStringA\" (Indicator: \"GrayStringA\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp\")\n Found reference to API \"GrayStringW\" (Indicator: \"GrayStringW\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp\")","description_v2":["Found reference to API \"GrayStringA\" (Indicator: \"GrayStringA\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp\")","Found reference to API \"GrayStringW\" (Indicator: \"GrayStringW\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GrayStringA\" (Indicator: \"GrayStringA\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GrayStringW\" (Indicator: \"GrayStringW\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-175","type":6,"relevance":1,"name":"Calls an API typically used to load libraries","description":"\"regsvr32.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007376)\n \"regsvr32.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007376)\n \"regsvr32.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007376)\n \"regsvr32.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00007376)","description_v2":["\"regsvr32.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007376)","\"regsvr32.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007376)","\"regsvr32.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007376)","\"regsvr32.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00007376)"],"description_v3":[{"type":"text","value":"\"regsvr32.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007376)"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007376)"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007376)"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00007376)"}],"origin":"API Call","attck_id":"T1129","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1129","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-176","type":6,"relevance":1,"name":"Calls an API typically used to retrieve function addresses","description":"$7b","description_v2":["\"regsvr32.exe\" called \"GetProcAddress\" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007376)","\"regsvr32.exe\" called \"GetProcAddress\" with a parameter FlsAlloc (UID: 00000000-00007376)","\"regsvr32.exe\" called \"GetProcAddress\" with a parameter FlsSetValue (UID: 00000000-00007376)","\"regsvr32.exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00007376)","\"regsvr32.exe\" called \"GetProcAddress\" with a parameter LCMapStringEx (UID: 00000000-00007376)","\"regsvr32.exe\" called \"GetProcAddress\" with a parameter FlsFree (UID: 00000000-00007376)","\"regsvr32.exe\" called \"GetProcAddress\" with a parameter InitOnceExecuteOnce (UID: 00000000-00007376)","\"regsvr32.exe\" called \"GetProcAddress\" with a parameter CreateEventExW (UID: 00000000-00007376)","\"regsvr32.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreW (UID: 00000000-00007376)","\"regsvr32.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreExW (UID: 00000000-00007376)","\"regsvr32.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolTimer (UID: 00000000-00007376)","\"regsvr32.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolTimer (UID: 00000000-00007376)","\"regsvr32.exe\" called \"GetProcAddress\" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007376)","\"regsvr32.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolTimer (UID: 00000000-00007376)","\"regsvr32.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWait (UID: 00000000-00007376)","\"regsvr32.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolWait (UID: 00000000-00007376)","\"regsvr32.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWait (UID: 00000000-00007376)","\"regsvr32.exe\" called \"GetProcAddress\" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007376)","\"regsvr32.exe\" called \"GetProcAddress\" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007376)","\"regsvr32.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007376)","\"regsvr32.exe\" called \"GetProcAddress\" with a parameter CreateSymbolicLinkW (UID: 00000000-00007376)","\"regsvr32.exe\" called \"GetProcAddress\" with a parameter GetCurrentPackageId (UID: 00000000-00007376)","\"regsvr32.exe\" called \"GetProcAddress\" with a parameter GetTickCount64 (UID: 00000000-00007376)","\"regsvr32.exe\" called \"GetProcAddress\" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007376)","\"regsvr32.exe\" called \"GetProcAddress\" with a parameter SetFileInformationByHandle (UID: 00000000-00007376)","\"regsvr32.exe\" called \"GetProcAddress\" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007376)","\"regsvr32.exe\" called \"GetProcAddress\" with a parameter InitializeConditionVariable (UID: 00000000-00007376)","\"regsvr32.exe\" called \"GetProcAddress\" with a parameter WakeConditionVariable (UID: 00000000-00007376)","\"regsvr32.exe\" called \"GetProcAddress\" with a parameter WakeAllConditionVariable (UID: 00000000-00007376)","\"regsvr32.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableCS (UID: 00000000-00007376)","\"regsvr32.exe\" called \"GetProcAddress\" with a parameter InitializeSRWLock (UID: 00000000-00007376)","\"regsvr32.exe\" called \"GetProcAddress\" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007376)","\"regsvr32.exe\" called \"GetProcAddress\" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007376)","\"regsvr32.exe\" called \"GetProcAddress\" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007376)","\"regsvr32.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableSRW (UID: 00000000-00007376)","\"regsvr32.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWork (UID: 00000000-00007376)","\"regsvr32.exe\" called \"GetProcAddress\" with a parameter SubmitThreadpoolWork (UID: 00000000-00007376)","\"regsvr32.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWork (UID: 00000000-00007376)","\"regsvr32.exe\" called \"GetProcAddress\" with a parameter CompareStringEx (UID: 00000000-00007376)","\"regsvr32.exe\" called \"GetProcAddress\" with a parameter GetLocaleInfoEx (UID: 00000000-00007376)","\"regsvr32.exe\" called \"GetProcAddress\" with a parameter AreFileApisANSI (UID: 00000000-00007376)","\"regsvr32.exe\" called \"GetProcAddress\" with a parameter RtlGetVersion (UID: 00000000-00007376)","\"regsvr32.exe\" called \"GetProcAddress\" with a parameter CoCreateInstance (UID: 00000000-00007376)","\"regsvr32.exe\" called \"GetProcAddress\" with a parameter CoCreateInstanceEx (UID: 00000000-00007376)","\"regsvr32.exe\" called \"GetProcAddress\" with a parameter CoGetClassObject (UID: 00000000-00007376)","\"regsvr32.exe\" called \"GetProcAddress\" with a parameter CoGetInstanceFromFile (UID: 00000000-00007376)","\"regsvr32.exe\" called \"GetProcAddress\" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007376)"],"description_v3":[{"type":"text","value":"\"regsvr32.exe\" called \"GetProcAddress\" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007376)"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" called \"GetProcAddress\" with a parameter FlsAlloc (UID: 00000000-00007376)"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" called \"GetProcAddress\" with a parameter FlsSetValue (UID: 00000000-00007376)"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00007376)"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" called \"GetProcAddress\" with a parameter LCMapStringEx (UID: 00000000-00007376)"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" called \"GetProcAddress\" with a parameter FlsFree (UID: 00000000-00007376)"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" called \"GetProcAddress\" with a parameter InitOnceExecuteOnce (UID: 00000000-00007376)"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" called \"GetProcAddress\" with a parameter CreateEventExW (UID: 00000000-00007376)"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreW (UID: 00000000-00007376)"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreExW (UID: 00000000-00007376)"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolTimer (UID: 00000000-00007376)"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolTimer (UID: 00000000-00007376)"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" called \"GetProcAddress\" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007376)"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolTimer (UID: 00000000-00007376)"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWait (UID: 00000000-00007376)"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolWait (UID: 00000000-00007376)"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWait (UID: 00000000-00007376)"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" called \"GetProcAddress\" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007376)"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" called \"GetProcAddress\" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007376)"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007376)"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" called \"GetProcAddress\" with a parameter CreateSymbolicLinkW (UID: 00000000-00007376)"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" called \"GetProcAddress\" with a parameter GetCurrentPackageId (UID: 00000000-00007376)"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" called \"GetProcAddress\" with a parameter GetTickCount64 (UID: 00000000-00007376)"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" called \"GetProcAddress\" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007376)"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" called \"GetProcAddress\" with a parameter SetFileInformationByHandle (UID: 00000000-00007376)"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" called \"GetProcAddress\" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007376)"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" called \"GetProcAddress\" with a parameter InitializeConditionVariable (UID: 00000000-00007376)"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" called \"GetProcAddress\" with a parameter WakeConditionVariable (UID: 00000000-00007376)"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" called \"GetProcAddress\" with a parameter WakeAllConditionVariable (UID: 00000000-00007376)"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableCS (UID: 00000000-00007376)"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" called \"GetProcAddress\" with a parameter InitializeSRWLock (UID: 00000000-00007376)"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" called \"GetProcAddress\" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007376)"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" called \"GetProcAddress\" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007376)"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" called \"GetProcAddress\" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007376)"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableSRW (UID: 00000000-00007376)"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWork (UID: 00000000-00007376)"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" called \"GetProcAddress\" with a parameter SubmitThreadpoolWork (UID: 00000000-00007376)"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWork (UID: 00000000-00007376)"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" called \"GetProcAddress\" with a parameter CompareStringEx (UID: 00000000-00007376)"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" called \"GetProcAddress\" with a parameter GetLocaleInfoEx (UID: 00000000-00007376)"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" called \"GetProcAddress\" with a parameter AreFileApisANSI (UID: 00000000-00007376)"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" called \"GetProcAddress\" with a parameter RtlGetVersion (UID: 00000000-00007376)"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" called \"GetProcAddress\" with a parameter CoCreateInstance (UID: 00000000-00007376)"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" called \"GetProcAddress\" with a parameter CoCreateInstanceEx (UID: 00000000-00007376)"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" called \"GetProcAddress\" with a parameter CoGetClassObject (UID: 00000000-00007376)"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" called \"GetProcAddress\" with a parameter CoGetInstanceFromFile (UID: 00000000-00007376)"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" called \"GetProcAddress\" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007376)"}],"origin":"API Call","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-7","type":2,"relevance":1,"name":"Contains PDB pathways","description":"\"regsvr32.pdb\"","description_v2":["\"regsvr32.pdb\""],"description_v3":[{"type":"text","value":"\"regsvr32.pdb\""}],"origin":"File/Memory","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-16","type":2,"relevance":2,"name":"Contains SQL queries","description":"$7c","description_v2":["\"SELECT * FROM MSACPI_THERMALZONETEMPERATURE\" (Source: 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, Indicator: \"select * from msacpi_thermalzonetemperature\")","\"SELECT * FROM WIN32_FAN\" (Source: 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, Indicator: \"select * from win32_fan\")","\"SELECT * FROM WIN32_CACHEMEMORY\" (Source: 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, Indicator: \"select * from win32_cachememory\")","\"SELECT * FROM WIN32_PHYSICALMEMORY\" (Source: 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, Indicator: \"select * from win32_physicalmemory\")","\"SELECT * FROM WIN32_MEMORYDEVICE\" (Source: 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, Indicator: \"select * from win32_memorydevice\")","\"SELECT * FROM WIN32_MEMORYARRAY\" (Source: 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, Indicator: \"select * from win32_memoryarray\")","\"SELECT * FROM WIN32_VOLTAGEPROBE\" (Source: 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, Indicator: \"select * from win32_voltageprobe\")","\"SELECT * FROM WIN32_PORTCONNECTOR\" (Source: 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, Indicator: \"select * from win32_portconnector\")","\"SELECT * FROM WIN32_SMBIOSMEMORY\" (Source: 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, Indicator: \"select * from win32_smbiosmemory\")","\"SELECT * FROM WIN32_PERFFORMATTEDDATA_COUNTERS_THERMALZONEINFORMATION\" (Source: 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, Indicator: \"select * from win32_perfformatteddata_counters_thermalzoneinformation\")","\"SELECT * FROM CIM_MEMORY\" (Source: 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, Indicator: \"select * from cim_memory\")","\"SELECT * FROM CIM_NUMERICSENSOR\" (Source: 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, Indicator: \"select * from cim_numericsensor\")","\"SELECT * FROM CIM_PHYSICALCONNECTOR\" (Source: 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, Indicator: \"select * from cim_physicalconnector\")","\"SELECT * FROM CIM_SENSOR\" (Source: 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, Indicator: \"select * from cim_sensor\")","\"SELECT * FROM CIM_SLOT\" (Source: 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, Indicator: \"select * from cim_slot\")","\"SELECT * FROM CIM_TEMPERATURESENSOR\" (Source: 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, Indicator: \"select * from cim_temperaturesensor\")","\"SELECT * FROM CIM_VOLTAGESENSOR\" (Source: 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, Indicator: \"select * from cim_voltagesensor\")"],"description_v3":[{"type":"text","value":"\"SELECT * FROM MSACPI_THERMALZONETEMPERATURE\" (Source: 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, Indicator: \"select * from msacpi_thermalzonetemperature\")"},{"type":"linebreak"},{"type":"text","value":"\"SELECT * FROM WIN32_FAN\" (Source: 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, Indicator: \"select * from win32_fan\")"},{"type":"linebreak"},{"type":"text","value":"\"SELECT * FROM WIN32_CACHEMEMORY\" (Source: 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, Indicator: \"select * from win32_cachememory\")"},{"type":"linebreak"},{"type":"text","value":"\"SELECT * FROM WIN32_PHYSICALMEMORY\" (Source: 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, Indicator: \"select * from win32_physicalmemory\")"},{"type":"linebreak"},{"type":"text","value":"\"SELECT * FROM WIN32_MEMORYDEVICE\" (Source: 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, Indicator: \"select * from win32_memorydevice\")"},{"type":"linebreak"},{"type":"text","value":"\"SELECT * FROM WIN32_MEMORYARRAY\" (Source: 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, Indicator: \"select * from win32_memoryarray\")"},{"type":"linebreak"},{"type":"text","value":"\"SELECT * FROM WIN32_VOLTAGEPROBE\" (Source: 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, Indicator: \"select * from win32_voltageprobe\")"},{"type":"linebreak"},{"type":"text","value":"\"SELECT * FROM WIN32_PORTCONNECTOR\" (Source: 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, Indicator: \"select * from win32_portconnector\")"},{"type":"linebreak"},{"type":"text","value":"\"SELECT * FROM WIN32_SMBIOSMEMORY\" (Source: 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, Indicator: \"select * from win32_smbiosmemory\")"},{"type":"linebreak"},{"type":"text","value":"\"SELECT * FROM WIN32_PERFFORMATTEDDATA_COUNTERS_THERMALZONEINFORMATION\" (Source: 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, Indicator: \"select * from win32_perfformatteddata_counters_thermalzoneinformation\")"},{"type":"linebreak"},{"type":"text","value":"\"SELECT * FROM CIM_MEMORY\" (Source: 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, Indicator: \"select * from cim_memory\")"},{"type":"linebreak"},{"type":"text","value":"\"SELECT * FROM CIM_NUMERICSENSOR\" (Source: 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, Indicator: \"select * from cim_numericsensor\")"},{"type":"linebreak"},{"type":"text","value":"\"SELECT * FROM CIM_PHYSICALCONNECTOR\" (Source: 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, Indicator: \"select * from cim_physicalconnector\")"},{"type":"linebreak"},{"type":"text","value":"\"SELECT * FROM CIM_SENSOR\" (Source: 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, Indicator: \"select * from cim_sensor\")"},{"type":"linebreak"},{"type":"text","value":"\"SELECT * FROM CIM_SLOT\" (Source: 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, Indicator: \"select * from cim_slot\")"},{"type":"linebreak"},{"type":"text","value":"\"SELECT * FROM CIM_TEMPERATURESENSOR\" (Source: 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, Indicator: \"select * from cim_temperaturesensor\")"},{"type":"linebreak"},{"type":"text","value":"\"SELECT * FROM CIM_VOLTAGESENSOR\" (Source: 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, Indicator: \"select * from cim_voltagesensor\")"}],"origin":"File/Memory","attck_id":"T1213","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1213","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-242","type":2,"relevance":1,"name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.74BC1000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","description_v2":["Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.74BC1000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.74BC1000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1489","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1489","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-204","type":2,"relevance":1,"name":"Contains ability to create a new process (API string)","description":"$7d","description_v2":["Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"hook_CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"hook_CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"CreateProcessWithTokenW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"ElevateCreateProcess\" (Indicator: \"CreateProcess\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_ElevateCreateProcess::IsExeManifested\" (Indicator: \"CreateProcess\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_ElevateCreateProcess::AdminCheckAndLaunch\" (Indicator: \"CreateProcess\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_ElevateCreateProcess::WidenStringsAndLaunch\" (Indicator: \"CreateProcess\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_ElevateCreateProcess::APIHook_CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_ElevateCreateProcess::APIHook_CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_ElevateCreateProcess::APIHook_WinExec\" (Indicator: \"CreateProcess\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_ElevateCreateProcess::APIHook_RegisterWaitForInputIdle\" (Indicator: \"CreateProcess\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_ElevateCreateProcess::InitializeHooksMulti\" (Indicator: \"CreateProcess\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"[LaunchFeedbackUI] CreateProcess failed\" (Indicator: \"CreateProcess\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"CreateProcessAsUserA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"hook_CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"hook_CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateProcessWithTokenW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ElevateCreateProcess\" (Indicator: \"CreateProcess\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_ElevateCreateProcess::IsExeManifested\" (Indicator: \"CreateProcess\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_ElevateCreateProcess::AdminCheckAndLaunch\" (Indicator: \"CreateProcess\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_ElevateCreateProcess::WidenStringsAndLaunch\" (Indicator: \"CreateProcess\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_ElevateCreateProcess::APIHook_CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_ElevateCreateProcess::APIHook_CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_ElevateCreateProcess::APIHook_WinExec\" (Indicator: \"CreateProcess\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_ElevateCreateProcess::APIHook_RegisterWaitForInputIdle\" (Indicator: \"CreateProcess\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_ElevateCreateProcess::InitializeHooksMulti\" (Indicator: \"CreateProcess\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"[LaunchFeedbackUI] CreateProcess failed\" (Indicator: \"CreateProcess\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateProcessAsUserA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-214","type":2,"relevance":1,"name":"Contains ability to create a new user account (API string)","description":"Found reference to API \"NetUserAdd\" (Indicator: \"NetUserAdd\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","description_v2":["Found reference to API \"NetUserAdd\" (Indicator: \"NetUserAdd\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"NetUserAdd\" (Indicator: \"NetUserAdd\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1136.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1136/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-423","type":2,"relevance":1,"name":"Contains ability to create directories (API string)","description":"$7e","description_v2":["Found reference to API \"hook_CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"hook_CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"NtCreateDirectoryObject\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"hook_CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"hook_CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NtCreateDirectoryObject\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1074.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1074/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-220","type":2,"relevance":1,"name":"Contains ability to create/control drivers (API string)","description":"$7f","description_v2":["Found reference to API \"NtDeviceIoControlFile\" (Indicator: \"NtDeviceIoControlFile\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.74736000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")","Found reference to API \"NtDeviceIoControlFile\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.74736000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")","Found reference to API \"NtFsControlFile\" (Indicator: \"FsControlFile\"; Source: \"00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.74736000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"NtDeviceIoControlFile\" (Indicator: \"NtDeviceIoControlFile\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.74736000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NtDeviceIoControlFile\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.74736000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NtFsControlFile\" (Indicator: \"FsControlFile\"; Source: \"00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.74736000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1543.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1543/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-315","type":2,"relevance":1,"name":"Contains ability to create/open files (API string)","description":"$80","description_v2":["Found reference to API \"\" (Indicator: \"CreateFile\"; Source: \"00000000-00007376.00000000.113264.00680000.00000004.mdmp\")","Found reference to API \"\" (Indicator: \"CreateFile\"; Source: \"00000000-00007376.00000000.113264.00680000.00000004.mdmp\")","$81","Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","$82","Found reference to API \"NtOpenFile\" (Indicator: \"NtOpenFile\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.74736000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74893000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")","Found reference to API \"NtCreateFile\" (Indicator: \"CreateFile\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")","Found reference to API \"NtCreateFile\" (Indicator: \"NtCreateFile\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")","Found reference to API \"NS_RedirectBDE::APIHook_CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"[CreateFileA] ExpandEnvironmentStringsA failed\" (Indicator: \"CreateFile\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"[CreateFileA] Unexpected failure after redirection.\" (Indicator: \"CreateFile\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_SyncSystem32AndSysWow64::APIHook_CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_SyncSystem32AndSysWow64::APIHook_CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_SyncSystemAndSystem32::APIHook_CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_SyncSystemAndSystem32::APIHook_CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NtCreateFile failed [%x]\" (Indicator: \"CreateFile\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"NtCreateFile failed [%x]\" (Indicator: \"NtCreateFile\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"CreateFileMappingA\" (Indicator: \"CreateFile\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"\" (Indicator: \"CreateFile\"; Source: \"00000000-00007376.00000000.113264.00680000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"\" (Indicator: \"CreateFile\"; Source: \"00000000-00007376.00000000.113264.00680000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"$83"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"$84"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NtOpenFile\" (Indicator: \"NtOpenFile\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.73465000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.74736000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74893000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NtCreateFile\" (Indicator: \"CreateFile\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NtCreateFile\" (Indicator: \"NtCreateFile\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74435000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_RedirectBDE::APIHook_CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"[CreateFileA] ExpandEnvironmentStringsA failed\" (Indicator: \"CreateFile\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"[CreateFileA] Unexpected failure after redirection.\" (Indicator: \"CreateFile\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_SyncSystem32AndSysWow64::APIHook_CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_SyncSystem32AndSysWow64::APIHook_CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_SyncSystemAndSystem32::APIHook_CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_SyncSystemAndSystem32::APIHook_CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NtCreateFile failed [%x]\" (Indicator: \"CreateFile\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NtCreateFile failed [%x]\" (Indicator: \"NtCreateFile\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateFileMappingA\" (Indicator: \"CreateFile\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"stream-103","type":1,"relevance":3,"name":"Contains ability to delay the execution of current thread","description":"Sleep at 00000000-00007376-36839-17-00D231F0\n WaitForSingleObject at 00000000-00007376-36839-27-00D21962","description_v2":["Sleep at 00000000-00007376-36839-17-00D231F0","WaitForSingleObject at 00000000-00007376-36839-27-00D21962"],"description_v3":[{"type":"text","value":"Sleep"},{"type":"stream","stream_uid":"00000000-00007376-36839-17-00D231F0","modal_link":"/bff/report/68b8504446b83fb2480c50bd/processes/00000000-00007376/streams/0/00000000-00007376-36839-17-00D231F0","process":{"name":"regsvr32.exe","process_uid":"00000000-00007376","pid":"7376"}},{"type":"linebreak"},{"type":"text","value":"WaitForSingleObject"},{"type":"stream","stream_uid":"00000000-00007376-36839-27-00D21962","modal_link":"/bff/report/68b8504446b83fb2480c50bd/processes/00000000-00007376/streams/0/00000000-00007376-36839-27-00D21962","process":{"name":"regsvr32.exe","process_uid":"00000000-00007376","pid":"7376"}}],"origin":"Hybrid Analysis Technology","attck_id":"T1497.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1497/003","stream_data":{"modal_link":"/bff/report/68b8504446b83fb2480c50bd/processes/00000000-00007376/streams/0/00000000-00007376-36839-17-00D231F0","name":"regsvr32.exe","pid":7376}},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-345","type":2,"relevance":1,"name":"Contains ability to disable/close registry key (API string)","description":"$85","description_v2":["$86"],"description_v3":[{"type":"text","value":"$87"}],"origin":"File/Memory","attck_id":"T1112","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1112","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"stream-108","type":1,"relevance":3,"name":"Contains ability to dynamically load libraries","description":"LoadLibraryExW at 00000000-00007376-36839-20-00D21F2B\n LoadLibraryExA at 00000000-00007376-36839-53-00D22C5A","description_v2":["LoadLibraryExW at 00000000-00007376-36839-20-00D21F2B","LoadLibraryExA at 00000000-00007376-36839-53-00D22C5A"],"description_v3":[{"type":"text","value":"LoadLibraryExW"},{"type":"stream","stream_uid":"00000000-00007376-36839-20-00D21F2B","modal_link":"/bff/report/68b8504446b83fb2480c50bd/processes/00000000-00007376/streams/0/00000000-00007376-36839-20-00D21F2B","process":{"name":"regsvr32.exe","process_uid":"00000000-00007376","pid":"7376"}},{"type":"linebreak"},{"type":"text","value":"LoadLibraryExA"},{"type":"stream","stream_uid":"00000000-00007376-36839-53-00D22C5A","modal_link":"/bff/report/68b8504446b83fb2480c50bd/processes/00000000-00007376/streams/0/00000000-00007376-36839-53-00D22C5A","process":{"name":"regsvr32.exe","process_uid":"00000000-00007376","pid":"7376"}}],"origin":"Hybrid Analysis Technology","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":{"modal_link":"/bff/report/68b8504446b83fb2480c50bd/processes/00000000-00007376/streams/0/00000000-00007376-36839-20-00D21F2B","name":"regsvr32.exe","pid":7376}},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-101","type":2,"relevance":1,"name":"Contains ability to execute Windows APIs","description":"details too long to display","description_v2":["details too long to display"],"description_v3":[{"type":"text","value":"details too long to display"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-240","type":2,"relevance":1,"name":"Contains ability to execute an application (API string)","description":"$88","description_v2":["Found reference to API \"hook_ShellExecuteA\" (Indicator: \"ShellExecute\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"hook_ShellExecuteW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"hook_WinExec\" (Indicator: \"WinExec\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"WinExec\" (Indicator: \"WinExec\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"NS_ElevateCreateProcess::APIHook_WinExec\" (Indicator: \"WinExec\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"hook_ShellExecuteA\" (Indicator: \"ShellExecute\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"hook_ShellExecuteW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"hook_WinExec\" (Indicator: \"WinExec\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WinExec\" (Indicator: \"WinExec\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_ElevateCreateProcess::APIHook_WinExec\" (Indicator: \"WinExec\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-550","type":2,"relevance":1,"name":"Contains ability to find and load resources of specific modules (API string)","description":"$89","description_v2":["Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"hook_FindResourceA\" (Indicator: \"FindResource\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"hook_FindResourceW\" (Indicator: \"FindResource\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"hook_LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"FindResourceA\" (Indicator: \"FindResource\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"LdrResFindResource failed [%x]\" (Indicator: \"FindResource\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp\")","Found reference to API \"LdrResFindResource failed %ls [%x]\" (Indicator: \"FindResource\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp\")","Found reference to API \"LdrResFindResource returned null version block with status: [%x]\" (Indicator: \"FindResource\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"hook_FindResourceA\" (Indicator: \"FindResource\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"hook_FindResourceW\" (Indicator: \"FindResource\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"hook_LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindResourceA\" (Indicator: \"FindResource\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LdrResFindResource failed [%x]\" (Indicator: \"FindResource\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LdrResFindResource failed %ls [%x]\" (Indicator: \"FindResource\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LdrResFindResource returned null version block with status: [%x]\" (Indicator: \"FindResource\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-424","type":2,"relevance":1,"name":"Contains ability to load modules (API string)","description":"Found reference to API \"PrintDriverSandboxLoadModule\" (Indicator: \"LoadModule\"; Source: \"00000000-00007376.00000000.113264.7309D000.00000002.mdmp\")","description_v2":["Found reference to API \"PrintDriverSandboxLoadModule\" (Indicator: \"LoadModule\"; Source: \"00000000-00007376.00000000.113264.7309D000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"PrintDriverSandboxLoadModule\" (Indicator: \"LoadModule\"; Source: \"00000000-00007376.00000000.113264.7309D000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-322","type":2,"relevance":1,"name":"Contains ability to move file or directory (API string)","description":"$8a","description_v2":["Found reference to API \"\" (Indicator: \"MoveFile\"; Source: \"00000000-00007376.00000000.113264.00680000.00000004.mdmp\")","Found reference to API \"\" (Indicator: \"MoveFile\"; Source: \"00000000-00007376.00000000.113264.00680000.00000004.mdmp\")","Found reference to API \"\" (Indicator: \"MoveFile\"; Source: \"00000000-00007376.00000000.113264.00680000.00000004.mdmp\")","Found reference to API \"\" (Indicator: \"MoveFile\"; Source: \"00000000-00007376.00000000.113264.00680000.00000004.mdmp\")","Found reference to API \"MoveFileA\" (Indicator: \"MoveFile\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74531000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74531000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"MoveFileExA\" (Indicator: \"MoveFile\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"NS_MoveToCopyFileShim::APIHook_MoveFileA\" (Indicator: \"MoveFile\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"[MoveFileA] DeleteFileA failed\" (Indicator: \"MoveFile\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_MoveToCopyFileShim::APIHook_MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"[MoveFileW] DeleteFileW failed\" (Indicator: \"MoveFile\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"\" (Indicator: \"MoveFile\"; Source: \"00000000-00007376.00000000.113264.00680000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"\" (Indicator: \"MoveFile\"; Source: \"00000000-00007376.00000000.113264.00680000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"\" (Indicator: \"MoveFile\"; Source: \"00000000-00007376.00000000.113264.00680000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"\" (Indicator: \"MoveFile\"; Source: \"00000000-00007376.00000000.113264.00680000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"MoveFileA\" (Indicator: \"MoveFile\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74531000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74531000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"MoveFileExA\" (Indicator: \"MoveFile\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_MoveToCopyFileShim::APIHook_MoveFileA\" (Indicator: \"MoveFile\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"[MoveFileA] DeleteFileA failed\" (Indicator: \"MoveFile\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_MoveToCopyFileShim::APIHook_MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"[MoveFileW] DeleteFileW failed\" (Indicator: \"MoveFile\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1570","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1570","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-467","type":2,"relevance":1,"name":"Contains ability to open handle to a named event object (API string)","description":"Found reference to API \"NtOpenEvent\" (Indicator: \"NtOpenEvent\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")","description_v2":["Found reference to API \"NtOpenEvent\" (Indicator: \"NtOpenEvent\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"NtOpenEvent\" (Indicator: \"NtOpenEvent\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-206","type":2,"relevance":1,"name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"$8b","description_v2":["Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1059.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1059/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-161","type":2,"relevance":1,"name":"Contains ability to retrieve/modify process thread (API string)","description":"$8c","description_v2":["Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"CreateThreadpoolWait\" (Indicator: \"CreateThread\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"CreateThreadpoolWork\" (Indicator: \"CreateThread\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"NtCreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")","Found reference to API \"NtCreateThreadEx\" (Indicator: \"CreateThread\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")","Found reference to API \"NtOpenThread\" (Indicator: \"OpenThread\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")","Found reference to API \"NtResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")","Found reference to API \"NtSuspendThread\" (Indicator: \"SuspendThread\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")","Found reference to API \"NtOpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.74736000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")","$8d","$8e"],"description_v3":[{"type":"text","value":"Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateThreadpoolWait\" (Indicator: \"CreateThread\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateThreadpoolWork\" (Indicator: \"CreateThread\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NtCreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NtCreateThreadEx\" (Indicator: \"CreateThread\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NtOpenThread\" (Indicator: \"OpenThread\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NtResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NtSuspendThread\" (Indicator: \"SuspendThread\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NtOpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.74736000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"$8f"},{"type":"linebreak"},{"type":"text","value":"$90"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-272","type":2,"relevance":1,"name":"Contains ability to retrieve/open a process (API string)","description":"$91","description_v2":["$92","Found reference to API \"NtOpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")","Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")","$93","Found reference to API \"[GetStringSID] Failed to OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NtOpenProcessToken failed [%x]\" (Indicator: \"OpenProcess\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"$94"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NtOpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"$95"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"[GetStringSID] Failed to OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NtOpenProcessToken failed [%x]\" (Indicator: \"OpenProcess\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-319","type":2,"relevance":1,"name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$96","description_v2":["$97","$98","Found reference to API \"GetLastError()\" (Indicator: \"GetLastError\"; Source: \"00000000-00007376.00000000.113264.72F31000.00000020.mdmp, 00000000-00007376.00000000.113264.73451000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"$99"},{"type":"linebreak"},{"type":"text","value":"$9a"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetLastError()\" (Indicator: \"GetLastError\"; Source: \"00000000-00007376.00000000.113264.72F31000.00000020.mdmp, 00000000-00007376.00000000.113264.73451000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-208","type":2,"relevance":1,"name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.76501000.00000020.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")\n Found reference to API \"GetShellWindow\" (Indicator: \"GetShellWindow\"; Source: \"00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","description_v2":["Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.76501000.00000020.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GetShellWindow\" (Indicator: \"GetShellWindow\"; Source: \"00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.76501000.00000020.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetShellWindow\" (Indicator: \"GetShellWindow\"; Source: \"00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1564.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1564/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-209","type":2,"relevance":1,"name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","description_v2":["Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1543.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1543/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-571","type":2,"relevance":1,"name":"Contains reference to messaging system library (API string)","description":"Found string \"mapi32.dll\" (Indicator: \"MAPI32.dll\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","description_v2":["Found string \"mapi32.dll\" (Indicator: \"MAPI32.dll\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"mapi32.dll\" (Indicator: \"MAPI32.dll\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1137","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1137","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-120","type":2,"relevance":1,"name":"Contains registry location strings","description":"$9b","description_v2":["\"SOFTWARE\\Microsoft\\SystemCertificates\\Root\\Certificates\\2BD63D28D7BCD0E251195AEB519243C13142EBC3\" in Source: 00000000-00007376.00000000.113264.72F31000.00000020.mdmp","\"SOFTWARE\\Microsoft\\SystemCertificates\\Root\\Certificates\\8A334AA8052DD244A647306A76B8178FA215F344\" in Source: 00000000-00007376.00000000.113264.72F31000.00000020.mdmp","\"SOFTWARE\\Microsoft\\Cryptography\\Defaults\\Provider\" in Source: 00000000-00007376.00000000.113264.72F31000.00000020.mdmp","\"SOFTWARE\\Microsoft\\Cryptography\\Defaults\\Provider\\\" in Source: 00000000-00007376.00000000.113264.72F31000.00000020.mdmp","\"SOFTWARE\\Microsoft\\Cryptography\\Defaults\\Provider Types\\Type\" in Source: 00000000-00007376.00000000.113264.72F31000.00000020.mdmp","\"SOFTWARE\\Microsoft\\Cryptography\\Defaults\\Provider Types\" in Source: 00000000-00007376.00000000.113264.72F31000.00000020.mdmp","\"SOFTWARE\\Microsoft\\Cryptography\\Providers\\Type\" in Source: 00000000-00007376.00000000.113264.72F31000.00000020.mdmp","\"SYSTEM\\CurrentControlSet\\Control\\Print\" in Source: 00000000-00007376.00000000.113264.73051000.00000020.mdmp","\"System\\CurrentControlSet\\Control\\Print\" in Source: 00000000-00007376.00000000.113264.73051000.00000020.mdmp","\"Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\" in Source: 00000000-00007376.00000000.113264.73051000.00000020.mdmp","00000000-00007376.00000000.113264.77071000.00000020.mdmp","\"Software\\Microsoft\\Windows NT\\CurrentVersion\\Devices\" in Source: 00000000-00007376.00000000.113264.73051000.00000020.mdmp","\"System\\CurrentControlSet\\Control\\Print\\Environments\" in Source: 00000000-00007376.00000000.113264.73051000.00000020.mdmp","\"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Perflib\" in Source: 00000000-00007376.00000000.113264.73051000.00000020.mdmp","00000000-00007376.00000000.113264.74781000.00000020.mdmp","\"HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"SOFTWARE\\CLASSES\\PACKAGEDCOM\\PACKAGE\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"SOFTWARE\\Microsoft\\Office\\16.0\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"SOFTWARE\\Wow6432Node\\Microsoft\\Office\\16.0\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\App Paths\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCU\\%s\\COMMON\\GENERAL\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\%s\\COMMON\\InstallRoot\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCU\\%s\\%s\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\%s\\%s\\InstallRoot\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCU\\SOFTWARE\\Classes\\%s.Application\\CurVer\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCU\\SOFTWARE\\Classes\\%s.Application.%s\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\%s.Application\\CurVer\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\%s.Application.%s\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\%s.Application\\CurVer\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\%s.Application.%s\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\%s\\%s\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\%s\\LocalServer\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\%s\\LocalServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\%s\\LocalServer\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\%s\\LocalServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\WOW6432Node\\CLSID\\%s\\LocalServer\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\WOW6432Node\\CLSID\\%s\\LocalServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"\\Registry\\Machine\\Software\\Classes\\\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"\\REGISTRY\\MACHINE\\SOFTWARE\\WOW6432Node\\\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"\\REGISTRY\\MACHINE\\SOFTWARE\\WOW6432Node\\Classes\\\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"\\Registry\\Machine\\System\\ControlSet001\\\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"System\\CurrentControlSet\\Control\\Session Manager\\Environment\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","00000000-00007376.00000000.113264.77071000.00000020.mdmp","\"HKCR\\Excel.Application\\CLSID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\Implemented Categories\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\Implemented Categories\\{000C0118-0000-0000-C000-000000000046}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\InprocHandler32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\InprocServer32\\15.0.0.0\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\LocalServer\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\LocalServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\ProgID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\VersionIndependentProgID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\Excel.Application\\CLSID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\Implemented Categories\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\Implemented Categories\\{000C0118-0000-0000-C000-000000000046}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\InprocHandler32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\InprocServer32\\15.0.0.0\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\LocalServer\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\LocalServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\ProgID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\VersionIndependentProgID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\Outlook.Application\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\Outlook.Application\\CLSID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCU\\SOFTWARE\\Classes\\Outlook.Application\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCU\\SOFTWARE\\Classes\\Outlook.Application\\CLSID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\Interface\\{00063001-0000-0000-C000-000000000046}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\Interface\\{00063001-0000-0000-C000-000000000046}\\ProxyStubClsid\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\Interface\\{00063001-0000-0000-C000-000000000046}\\ProxyStubClsid32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\Interface\\{00063001-0000-0000-C000-000000000046}\\TypeLib\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\Interface\\{00063001-0000-0000-C000-000000000046}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\Interface\\{00063001-0000-0000-C000-000000000046}\\ProxyStubClsid\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\Interface\\{00063001-0000-0000-C000-000000000046}\\ProxyStubClsid32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\Interface\\{00063001-0000-0000-C000-000000000046}\\TypeLib\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCU\\SOFTWARE\\Classes\\Interface\\{00063001-0000-0000-C000-000000000046}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCU\\SOFTWARE\\Classes\\Interface\\{00063001-0000-0000-C000-000000000046}\\ProxyStubClsid\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCU\\SOFTWARE\\Classes\\Interface\\{00063001-0000-0000-C000-000000000046}\\ProxyStubClsid32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCU\\SOFTWARE\\Classes\\Interface\\{00063001-0000-0000-C000-000000000046}\\TypeLib\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Microsoft\\Office\\16.0\\Outlook\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\WOW6432Node\\Microsoft\\Office\\16.0\\Outlook\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Clients\\Mail\\Microsoft Outlook\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\InprocServer32\\15.0.0.0\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\PowerPoint.Application\\CLSID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\InprocHandler\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\InprocHandler32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\InprocServer32\\15.0.0.0\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\LocalServer\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\LocalServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\ProgID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\VersionIndependentProgID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\InprocServer32\\15.0.0.0\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\PowerPoint.Application\\CLSID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\InprocHandler\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\InprocHandler32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\InprocServer32\\15.0.0.0\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\LocalServer\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\LocalServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\ProgID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\VersionIndependentProgID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\Word.Application\\CLSID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\WOW6432Node\\CLSID\\{000209FF-0000-0000-C000-000000000046}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\WOW6432Node\\CLSID\\{000209FF-0000-0000-C000-000000000046}\\InprocHandler32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\WOW6432Node\\CLSID\\{000209FF-0000-0000-C000-000000000046}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\WOW6432Node\\CLSID\\{000209FF-0000-0000-C000-000000000046}\\InprocServer32\\15.0.0.0\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\WOW6432Node\\CLSID\\{000209FF-0000-0000-C000-000000000046}\\LocalServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\WOW6432Node\\CLSID\\{000209FF-0000-0000-C000-000000000046}\\ProgID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\WOW6432Node\\CLSID\\{000209FF-0000-0000-C000-000000000046}\\VersionIndependentProgID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\Word.Application\\CLSID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{000209FF-0000-0000-C000-000000000046}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{000209FF-0000-0000-C000-000000000046}\\InprocHandler32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{000209FF-0000-0000-C000-000000000046}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{000209FF-0000-0000-C000-000000000046}\\InprocServer32\\15.0.0.0\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{000209FF-0000-0000-C000-000000000046}\\LocalServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{000209FF-0000-0000-C000-000000000046}\\ProgID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{000209FF-0000-0000-C000-000000000046}\\VersionIndependentProgID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"System\\CurrentControlSet\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"SOFTWARE\\Classes\\CLSID\\%ls\\LocalServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"SOFTWARE\\Classes\\CLSID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCU\\Software\\Classes\\\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"Software\\Classes\\\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","00000000-00007376.00000000.113264.74781000.00000020.mdmp","00000000-00007376.00000000.113264.74D81000.00000020.mdmp","00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"HKCC\\System\\CurrentControlSet\\Control\\Print\\Printers\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Microsoft\\Direct3D\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"Software\\Classes\\Body5\\Open\\Shell\\Command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Encore Software\\Middle School Advantage 2001\\1.0\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\nowcom\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCU\\Software\\nowcom\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\nowirc\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCU\\Software\\nowirc\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\nownuri\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCU\\Software\\nownuri\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"Software\\Microsoft\\Windows NT\\CurrentVersion\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Microsoft\\MSN\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\MSN\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Config\\0001\\Display\\Settings\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"System\\CurrentControlSet\\Enum\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","00000000-00007376.00000000.113264.76941000.00000020.mdmp","\"HKLM\\System\\CurrentControlSet\\Enum\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCU\\Software\\Microsoft\\CTF\\LangBar\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\ODBC\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\System\\CurrentControlSet\\services\\W3svc\\Parameters\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Microsoft\\Outlook Express\\Inetcomm\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Microsoft\\Outlook Express\\Version Info\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Memory Management\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Memory Management\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{083863F1-70DE-11D0-BD40-00A0C911CE86}\\Instance\\{4CB63E61-C611-11D0-83AA-000092900184}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{4CB63E61-C611-11D0-83AA-000092900184}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{4CB63E61-C611-11D0-83AA-000092900184}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{4CB63E62-C611-11D0-83AA-000092900184}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{4CB63E62-C611-11D0-83AA-000092900184}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{083863F1-70DE-11D0-BD40-00A0C911CE86}\\Instance\\{B4CA2970-DD2B-11D0-9DFA-00AA00AF3494}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{B4CA2970-DD2B-11D0-9DFA-00AA00AF3494}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{B4CA2970-DD2B-11D0-9DFA-00AA00AF3494}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{B4CA2971-DD2B-11D0-9DFA-00AA00AF3494}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{B4CA2971-DD2B-11D0-9DFA-00AA00AF3494}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{C83B5610-E0DF-11D0-9E00-00AA00AF3494}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{C83B5610-E0DF-11D0-9E00-00AA00AF3494}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\drivers.desc\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Drivers32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\System\\CurrentControlSet\\Control\\MediaProperties\\PrivateProperties\\Joystick\\Winmm\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{31345649-0000-0010-8000-00AA00389B71}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{31345649-0000-0010-8000-00AA00389B71}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{31345649-0000-0010-8000-00AA00389B71}\\Pins\\Input\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{31345649-0000-0010-8000-00AA00389B71}\\Pins\\Input\\Types\\{73646976-0000-0010-8000-00AA00389B71}\\{31345649-0000-0010-8000-00AA00389B71}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{31345649-0000-0010-8000-00AA00389B71}\\Pins\\Output\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{31345649-0000-0010-8000-00AA00389B71}\\Pins\\Output\\Types\\{73646976-0000-0010-8000-00AA00389B71}\\{00000000-0000-0000-0000-000000000000}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{87CA6F02-49E4-11CF-A3FE-00AA003735BE}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{87CA6F02-49E4-11CF-A3FE-00AA003735BE}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{87CA6F04-49E4-11CF-A3FE-00AA003735BE}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{87CA6F04-49E4-11CF-A3FE-00AA003735BE}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{A2551F60-705F-11CF-A424-00AA003735BE}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{A2551F60-705F-11CF-A424-00AA003735BE}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{A2551F60-705F-11CF-A424-00AA003735BE}\\Pins\\Input\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{A2551F60-705F-11CF-A424-00AA003735BE}\\Pins\\Input\\Types\\{73646976-0000-0010-8000-00AA00389B71}\\{00000000-0000-0000-0000-000000000000}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{A2551F60-705F-11CF-A424-00AA003735BE}\\Pins\\Output\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{A2551F60-705F-11CF-A424-00AA003735BE}\\Pins\\Output\\Types\\{73646976-0000-0010-8000-00AA00389B71}\\{31345649-0000-0010-8000-00AA00389B71}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{BD323430-CE94-11CE-82DD-0800095A5B55}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{BD323430-CE94-11CE-82DD-0800095A5B55}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{BD323431-CE94-11CE-82DD-0800095A5B55}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{BD323431-CE94-11CE-82DD-0800095A5B55}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{BD323432-CE94-11CE-82DD-0800095A5B55}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{BD323432-CE94-11CE-82DD-0800095A5B55}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{BD323433-CE94-11CE-82DD-0800095A5B55}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{BD323433-CE94-11CE-82DD-0800095A5B55}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\Filter\\{31345649-0000-0010-8000-00AA00389B71}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\Filter\\{A2551F60-705F-11CF-A424-00AA003735BE}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCU\\Software\\Intel\\Indeo\\4.1\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{083863F1-70DE-11D0-BD40-00A0C911CE86}\\Instance\\{1F73E9B1-8C3A-11D0-A3BE-00A0C9244436}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{083863F1-70DE-11D0-BD40-00A0C911CE86}\\Instance\\{30355649-0000-0010-8000-00AA00389B71}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{1F73E9B1-8C3A-11D0-A3BE-00A0C9244436}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{1F73E9B1-8C3A-11D0-A3BE-00A0C9244436}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{2DE89781-DBF6-11D0-A30E-444553540000}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{2DE89781-DBF6-11D0-A30E-444553540000}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{30355649-0000-0010-8000-00AA00389B71}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{30355649-0000-0010-8000-00AA00389B71}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{33D9A760-90C8-11D0-BD43-00A0C911CE86}\\Instance\\Indeo\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{665A4443-D905-11D0-A30E-444553540000}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{665A4443-D905-11D0-A30E-444553540000}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{665A4444-D905-11D0-A30E-444553540000}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{665A4444-D905-11D0-A30E-444553540000}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{665A4445-D905-11D0-A30E-444553540000}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{665A4445-D905-11D0-A30E-444553540000}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{665A4448-D905-11D0-A30E-444553540000}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{665A4448-D905-11D0-A30E-444553540000}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{665A444A-D905-11D0-A30E-444553540000}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{665A444A-D905-11D0-A30E-444553540000}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{84725EA1-2FBC-11D1-BC86-00A0C969FC67}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{84725EA1-2FBC-11D1-BC86-00A0C969FC67}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{C1C0FE00-F3C2-11D0-91D4-444553540000}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{C1C0FE00-F3C2-11D0-91D4-444553540000}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{E369A160-F3C2-11D0-91D4-444553540000}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{E369A160-F3C2-11D0-91D4-444553540000}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\Interface\\{665A4447-D905-11D0-A30E-444553540000}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\Interface\\{665A4447-D905-11D0-A30E-444553540000}\\ProxyStubClsid\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\Interface\\{665A4447-D905-11D0-A30E-444553540000}\\ProxyStubClsid32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\Interface\\{665A4447-D905-11D0-A30E-444553540000}\\TypeLib\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\Interface\\{665A4449-D905-11D0-A30E-444553540000}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\Interface\\{665A4449-D905-11D0-A30E-444553540000}\\ProxyStubClsid\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\Interface\\{665A4449-D905-11D0-A30E-444553540000}\\ProxyStubClsid32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\Interface\\{665A4449-D905-11D0-A30E-444553540000}\\TypeLib\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\TypeLib\\{665A4446-D905-11D0-A30E-444553540000}\\1.0\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\TypeLib\\{665A4446-D905-11D0-A30E-444553540000}\\1.0\\0\\win32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\TypeLib\\{665A4446-D905-11D0-A30E-444553540000}\\1.0\\FLAGS\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\TypeLib\\{665A4446-D905-11D0-A30E-444553540000}\\1.0\\HELPDIR\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCU\\Software\\Classes\\iTunes.BurnCD\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\iTunes.BurnCD\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCU\\Software\\Classes\\MIME\\Database\\Content Type\\application/x-itunes-itms\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\MIME\\Database\\Content Type\\application/x-itunes-itms\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCU\\Software\\Classes\\MIME\\Database\\Content Type\\application/x-itunes-itpc\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\MIME\\Database\\Content Type\\application/x-itunes-itpc\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCU\\Software\\Classes\\MIME\\Database\\Content Type\\application/x-podcast\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\MIME\\Database\\Content Type\\application/x-podcast\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SYSTEM\\ControlSet001\\Control\\ProductOptions\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SYSTEM\\ControlSet002\\Control\\ProductOptions\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SYSTEM\\ControlSet003\\Control\\ProductOptions\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SYSTEM\\CurrentControlSet\\Control\\ProductOptions\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\chm.file\\shell\\open\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\software\\microsoft\\IE Setup\\SETUP\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\software\\microsoft\\Windows NT\\CurrentVersion\\Hotfix\\\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SYSTEM\\WPA\\MediaCenter\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\software\\microsoft\\Outlook Express\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Microsoft\\Direct3D\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Microsoft\\DirectDraw\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\ThemeManager\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Microsoft\\WAB\\DLLPath\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCU\\Software\\Microsoft\\Direct3D\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Microsoft\\Internet Explorer\\Version Vector\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Microsoft\\NET Framework Setup\\NDP\\v4\\Client\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Microsoft\\NET Framework Setup\\NDP\\v4\\Full\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Macromedia\\FlashPlayerActiveY_BOGUSKEY\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Macromedia\\FlashPlayerActiveX\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{031E4825-7B94-4dc3-B131-E946B44C8DD5}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Wow6432Node\\Microsoft\\NET Framework Setup\\NDP\\v4\\Client\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Wow6432Node\\Microsoft\\NET Framework Setup\\NDP\\v4\\Full\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Wow6432Node\\Microsoft\\Internet Explorer\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Controls Folder\\Desk\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Controls Folder\\Display\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\System\\CurrentControlSet\\Control\\Class\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\System\\CurrentControlSet\\Services\\Class\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\System\\CurrentControlSet\\Control\\Class\\{4D36E968-E325-11CE-BFC1-08002BE10318}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\System\\CurrentControlSet\\Services\\Class\\Display\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Cache\\Special Paths\\Cookies\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"SOFTWARE\\Hasbro Interactive\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SYSTEM\\CurrentControlSet\\Enum\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Enum\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"SYSTEM\\CurrentControlSet\\Enum\\PCI\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCC\\Software\\Fonts\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"System\\CurrentControlSet\\Control\\Nls\\Locale\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\WORDPAD.EXE\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\rtffile\\shell\\open\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\rtffile\\shell\\print\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\rtffile\\shell\\printto\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\Wordpad.Document.1\\shell\\open\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\Wordpad.Document.1\\shell\\print\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\Wordpad.Document.1\\shell\\printto\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\wrifile\\shell\\open\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\wrifile\\shell\\print\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\wrifile\\shell\\printto\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Classes\\Applications\\wordpad.exe\\shell\\open\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Classes\\Applications\\wordpad.exe\\shell\\print\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Classes\\Applications\\wordpad.exe\\shell\\printto\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Classes\\rtffile\\shell\\open\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Classes\\rtffile\\shell\\print\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Classes\\rtffile\\shell\\printto\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Classes\\Wordpad.Document.1\\shell\\open\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Classes\\Wordpad.Document.1\\shell\\print\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Classes\\Wordpad.Document.1\\shell\\printto\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Classes\\wrifile\\shell\\open\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Classes\\wrifile\\shell\\print\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Classes\\wrifile\\shell\\printto\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Setup\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"System\\CurrentControlSet\\Services\\NetBT\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"Software\\Microsoft\\Windows NT\\CurrentVersion\\NetworkCards\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\System\\CurrentControlSet\\Control\\Windows\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Applications\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Microsoft\\DirectX\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\DXDIAG.EXE\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Electronic Arts\\Future Cop\\Settings\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"Software\\Microsoft\\Windows NT\\CurrentVersion\\Drivers32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\System\\CurrentControlSet\\Control\\MediaResources\\ACM\\MSACM.MSADPCM\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Microsoft\\Windows\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCU\\Software\\Microsoft\\Windows\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"Software\\FirstByte\\ProVoice\\SpeechFonts\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Microsoft\\Internet Explorer\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"System\\CurrentControlSet\\Control\\MediaProperties\\PrivateProperties\\Joystick\\OEM\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCU\\Software\\Adobe\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Adobe\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Adobe\\PageMaker65\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCU\\Software\\Adobe\\PageMaker65\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCU\\Software\\Caere Corp\\PageKeepPro30\\Preference\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"Software\\Caere Corp\\Scan Manager\\4.02\\Scanners\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SYSTEM\\CurrentControlSet\\Enum\\Root\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\Components\\359E92CC2CB71D119A12000A9CE1A22A\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\System\\CurrentControlSet\\Services\\W3SVC\\Parameters\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\System\\CurrentControlSet\\Control\\MediaResources\\DirectSound\\Application Compatibility\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"\\Registry\\Machine\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Windows File Protection\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"\\Registry\\HKEY_CURRENT_USER\\Software\\Classes\\\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"Software\\Volatile\\00\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy\" in Source: 00000000-00007376.00000000.113264.73451000.00000020.mdmp","00000000-00007376.00000000.113264.74841000.00000020.mdmp","\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa\" in Source: 00000000-00007376.00000000.113264.73451000.00000020.mdmp","00000000-00007376.00000000.113264.74841000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Accent\" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp","\"Software\\Policies\\Microsoft\\Windows\\Personalization\" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp","\"Software\\Microsoft\\Windows\\DWM\" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\ImmersiveShell\" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\ThemeManager\" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp","\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp","\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\DiagnosticAnimationXML\" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp","00000000-00007376.00000000.113264.746E1000.00000020.mdmp","\".Default\\Software\\Microsoft\\Windows\\CurrentVersion\\ThemeManager\" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\Themes\\History\\Colors\" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\Themes\\History\" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp","\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Accents\" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp","\"Software\\Microsoft\\Wisp\\Touch\" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp","\"\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp","00000000-00007376.00000000.113264.77110000.00000002.mdmp","00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp","\"\\Software\\Classes\\CLSID\\\" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp","\"\\Registry\\Machine\\Software\\Microsoft\\Windows\\CurrentVersion\" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp","\"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp","\"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp","\"\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Layers\" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp","\"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\InstalledSDB\" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp","00000000-00007376.00000000.113264.77110000.00000002.mdmp","\"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Custom\" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp","\"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Disable8And16BitMitigation\" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp","\"SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp","\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp"],"description_v3":[{"type":"text","value":"\"SOFTWARE\\Microsoft\\SystemCertificates\\Root\\Certificates\\2BD63D28D7BCD0E251195AEB519243C13142EBC3\" in Source: 00000000-00007376.00000000.113264.72F31000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\SystemCertificates\\Root\\Certificates\\8A334AA8052DD244A647306A76B8178FA215F344\" in Source: 00000000-00007376.00000000.113264.72F31000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\Cryptography\\Defaults\\Provider\" in Source: 00000000-00007376.00000000.113264.72F31000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\Cryptography\\Defaults\\Provider\\\" in Source: 00000000-00007376.00000000.113264.72F31000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\Cryptography\\Defaults\\Provider Types\\Type\" in Source: 00000000-00007376.00000000.113264.72F31000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\Cryptography\\Defaults\\Provider Types\" in Source: 00000000-00007376.00000000.113264.72F31000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\Cryptography\\Providers\\Type\" in Source: 00000000-00007376.00000000.113264.72F31000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SYSTEM\\CurrentControlSet\\Control\\Print\" in Source: 00000000-00007376.00000000.113264.73051000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"System\\CurrentControlSet\\Control\\Print\" in Source: 00000000-00007376.00000000.113264.73051000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\" in Source: 00000000-00007376.00000000.113264.73051000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00007376.00000000.113264.77071000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows NT\\CurrentVersion\\Devices\" in Source: 00000000-00007376.00000000.113264.73051000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"System\\CurrentControlSet\\Control\\Print\\Environments\" in Source: 00000000-00007376.00000000.113264.73051000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Perflib\" in Source: 00000000-00007376.00000000.113264.73051000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00007376.00000000.113264.74781000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\CLASSES\\PACKAGEDCOM\\PACKAGE\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\Office\\16.0\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Wow6432Node\\Microsoft\\Office\\16.0\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\App Paths\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCU\\%s\\COMMON\\GENERAL\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\%s\\COMMON\\InstallRoot\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCU\\%s\\%s\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\%s\\%s\\InstallRoot\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCU\\SOFTWARE\\Classes\\%s.Application\\CurVer\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCU\\SOFTWARE\\Classes\\%s.Application.%s\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\%s.Application\\CurVer\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\%s.Application.%s\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\%s.Application\\CurVer\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\%s.Application.%s\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\%s\\%s\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\%s\\LocalServer\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\%s\\LocalServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\%s\\LocalServer\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\%s\\LocalServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\WOW6432Node\\CLSID\\%s\\LocalServer\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\WOW6432Node\\CLSID\\%s\\LocalServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\Software\\Classes\\\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\REGISTRY\\MACHINE\\SOFTWARE\\WOW6432Node\\\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\REGISTRY\\MACHINE\\SOFTWARE\\WOW6432Node\\Classes\\\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\System\\ControlSet001\\\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"System\\CurrentControlSet\\Control\\Session Manager\\Environment\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00007376.00000000.113264.77071000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\Excel.Application\\CLSID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\Implemented Categories\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\Implemented Categories\\{000C0118-0000-0000-C000-000000000046}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\InprocHandler32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\InprocServer32\\15.0.0.0\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\LocalServer\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\LocalServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\ProgID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\VersionIndependentProgID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\Excel.Application\\CLSID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\Implemented Categories\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\Implemented Categories\\{000C0118-0000-0000-C000-000000000046}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\InprocHandler32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\InprocServer32\\15.0.0.0\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\LocalServer\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\LocalServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\ProgID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\VersionIndependentProgID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\Outlook.Application\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\Outlook.Application\\CLSID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCU\\SOFTWARE\\Classes\\Outlook.Application\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCU\\SOFTWARE\\Classes\\Outlook.Application\\CLSID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\Interface\\{00063001-0000-0000-C000-000000000046}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\Interface\\{00063001-0000-0000-C000-000000000046}\\ProxyStubClsid\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\Interface\\{00063001-0000-0000-C000-000000000046}\\ProxyStubClsid32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\Interface\\{00063001-0000-0000-C000-000000000046}\\TypeLib\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\Interface\\{00063001-0000-0000-C000-000000000046}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\Interface\\{00063001-0000-0000-C000-000000000046}\\ProxyStubClsid\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\Interface\\{00063001-0000-0000-C000-000000000046}\\ProxyStubClsid32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\Interface\\{00063001-0000-0000-C000-000000000046}\\TypeLib\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCU\\SOFTWARE\\Classes\\Interface\\{00063001-0000-0000-C000-000000000046}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCU\\SOFTWARE\\Classes\\Interface\\{00063001-0000-0000-C000-000000000046}\\ProxyStubClsid\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCU\\SOFTWARE\\Classes\\Interface\\{00063001-0000-0000-C000-000000000046}\\ProxyStubClsid32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCU\\SOFTWARE\\Classes\\Interface\\{00063001-0000-0000-C000-000000000046}\\TypeLib\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Microsoft\\Office\\16.0\\Outlook\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\WOW6432Node\\Microsoft\\Office\\16.0\\Outlook\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Clients\\Mail\\Microsoft Outlook\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\InprocServer32\\15.0.0.0\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\PowerPoint.Application\\CLSID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\InprocHandler\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\InprocHandler32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\InprocServer32\\15.0.0.0\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\LocalServer\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\LocalServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\ProgID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\VersionIndependentProgID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\InprocServer32\\15.0.0.0\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\PowerPoint.Application\\CLSID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\InprocHandler\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\InprocHandler32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\InprocServer32\\15.0.0.0\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\LocalServer\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\LocalServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\ProgID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\VersionIndependentProgID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\Word.Application\\CLSID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\WOW6432Node\\CLSID\\{000209FF-0000-0000-C000-000000000046}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\WOW6432Node\\CLSID\\{000209FF-0000-0000-C000-000000000046}\\InprocHandler32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\WOW6432Node\\CLSID\\{000209FF-0000-0000-C000-000000000046}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\WOW6432Node\\CLSID\\{000209FF-0000-0000-C000-000000000046}\\InprocServer32\\15.0.0.0\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\WOW6432Node\\CLSID\\{000209FF-0000-0000-C000-000000000046}\\LocalServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\WOW6432Node\\CLSID\\{000209FF-0000-0000-C000-000000000046}\\ProgID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\WOW6432Node\\CLSID\\{000209FF-0000-0000-C000-000000000046}\\VersionIndependentProgID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\Word.Application\\CLSID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{000209FF-0000-0000-C000-000000000046}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{000209FF-0000-0000-C000-000000000046}\\InprocHandler32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{000209FF-0000-0000-C000-000000000046}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{000209FF-0000-0000-C000-000000000046}\\InprocServer32\\15.0.0.0\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{000209FF-0000-0000-C000-000000000046}\\LocalServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{000209FF-0000-0000-C000-000000000046}\\ProgID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{000209FF-0000-0000-C000-000000000046}\\VersionIndependentProgID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"System\\CurrentControlSet\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Classes\\CLSID\\%ls\\LocalServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Classes\\CLSID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCU\\Software\\Classes\\\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Classes\\\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00007376.00000000.113264.74781000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00007376.00000000.113264.74D81000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCC\\System\\CurrentControlSet\\Control\\Print\\Printers\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Microsoft\\Direct3D\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Classes\\Body5\\Open\\Shell\\Command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Encore Software\\Middle School Advantage 2001\\1.0\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\nowcom\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCU\\Software\\nowcom\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\nowirc\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCU\\Software\\nowirc\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\nownuri\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCU\\Software\\nownuri\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows NT\\CurrentVersion\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Microsoft\\MSN\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\MSN\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Config\\0001\\Display\\Settings\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"System\\CurrentControlSet\\Enum\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00007376.00000000.113264.76941000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\System\\CurrentControlSet\\Enum\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCU\\Software\\Microsoft\\CTF\\LangBar\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\ODBC\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\System\\CurrentControlSet\\services\\W3svc\\Parameters\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Microsoft\\Outlook Express\\Inetcomm\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Microsoft\\Outlook Express\\Version Info\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Memory Management\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Memory Management\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{083863F1-70DE-11D0-BD40-00A0C911CE86}\\Instance\\{4CB63E61-C611-11D0-83AA-000092900184}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{4CB63E61-C611-11D0-83AA-000092900184}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{4CB63E61-C611-11D0-83AA-000092900184}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{4CB63E62-C611-11D0-83AA-000092900184}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{4CB63E62-C611-11D0-83AA-000092900184}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{083863F1-70DE-11D0-BD40-00A0C911CE86}\\Instance\\{B4CA2970-DD2B-11D0-9DFA-00AA00AF3494}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{B4CA2970-DD2B-11D0-9DFA-00AA00AF3494}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{B4CA2970-DD2B-11D0-9DFA-00AA00AF3494}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{B4CA2971-DD2B-11D0-9DFA-00AA00AF3494}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{B4CA2971-DD2B-11D0-9DFA-00AA00AF3494}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{C83B5610-E0DF-11D0-9E00-00AA00AF3494}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{C83B5610-E0DF-11D0-9E00-00AA00AF3494}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\drivers.desc\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Drivers32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\System\\CurrentControlSet\\Control\\MediaProperties\\PrivateProperties\\Joystick\\Winmm\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{31345649-0000-0010-8000-00AA00389B71}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{31345649-0000-0010-8000-00AA00389B71}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{31345649-0000-0010-8000-00AA00389B71}\\Pins\\Input\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{31345649-0000-0010-8000-00AA00389B71}\\Pins\\Input\\Types\\{73646976-0000-0010-8000-00AA00389B71}\\{31345649-0000-0010-8000-00AA00389B71}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{31345649-0000-0010-8000-00AA00389B71}\\Pins\\Output\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{31345649-0000-0010-8000-00AA00389B71}\\Pins\\Output\\Types\\{73646976-0000-0010-8000-00AA00389B71}\\{00000000-0000-0000-0000-000000000000}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{87CA6F02-49E4-11CF-A3FE-00AA003735BE}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{87CA6F02-49E4-11CF-A3FE-00AA003735BE}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{87CA6F04-49E4-11CF-A3FE-00AA003735BE}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{87CA6F04-49E4-11CF-A3FE-00AA003735BE}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{A2551F60-705F-11CF-A424-00AA003735BE}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{A2551F60-705F-11CF-A424-00AA003735BE}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{A2551F60-705F-11CF-A424-00AA003735BE}\\Pins\\Input\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{A2551F60-705F-11CF-A424-00AA003735BE}\\Pins\\Input\\Types\\{73646976-0000-0010-8000-00AA00389B71}\\{00000000-0000-0000-0000-000000000000}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{A2551F60-705F-11CF-A424-00AA003735BE}\\Pins\\Output\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{A2551F60-705F-11CF-A424-00AA003735BE}\\Pins\\Output\\Types\\{73646976-0000-0010-8000-00AA00389B71}\\{31345649-0000-0010-8000-00AA00389B71}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{BD323430-CE94-11CE-82DD-0800095A5B55}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{BD323430-CE94-11CE-82DD-0800095A5B55}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{BD323431-CE94-11CE-82DD-0800095A5B55}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{BD323431-CE94-11CE-82DD-0800095A5B55}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{BD323432-CE94-11CE-82DD-0800095A5B55}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{BD323432-CE94-11CE-82DD-0800095A5B55}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{BD323433-CE94-11CE-82DD-0800095A5B55}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{BD323433-CE94-11CE-82DD-0800095A5B55}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\Filter\\{31345649-0000-0010-8000-00AA00389B71}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\Filter\\{A2551F60-705F-11CF-A424-00AA003735BE}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCU\\Software\\Intel\\Indeo\\4.1\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{083863F1-70DE-11D0-BD40-00A0C911CE86}\\Instance\\{1F73E9B1-8C3A-11D0-A3BE-00A0C9244436}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{083863F1-70DE-11D0-BD40-00A0C911CE86}\\Instance\\{30355649-0000-0010-8000-00AA00389B71}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{1F73E9B1-8C3A-11D0-A3BE-00A0C9244436}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{1F73E9B1-8C3A-11D0-A3BE-00A0C9244436}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{2DE89781-DBF6-11D0-A30E-444553540000}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{2DE89781-DBF6-11D0-A30E-444553540000}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{30355649-0000-0010-8000-00AA00389B71}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{30355649-0000-0010-8000-00AA00389B71}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{33D9A760-90C8-11D0-BD43-00A0C911CE86}\\Instance\\Indeo\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{665A4443-D905-11D0-A30E-444553540000}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{665A4443-D905-11D0-A30E-444553540000}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{665A4444-D905-11D0-A30E-444553540000}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{665A4444-D905-11D0-A30E-444553540000}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{665A4445-D905-11D0-A30E-444553540000}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{665A4445-D905-11D0-A30E-444553540000}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{665A4448-D905-11D0-A30E-444553540000}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{665A4448-D905-11D0-A30E-444553540000}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{665A444A-D905-11D0-A30E-444553540000}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{665A444A-D905-11D0-A30E-444553540000}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{84725EA1-2FBC-11D1-BC86-00A0C969FC67}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{84725EA1-2FBC-11D1-BC86-00A0C969FC67}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{C1C0FE00-F3C2-11D0-91D4-444553540000}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{C1C0FE00-F3C2-11D0-91D4-444553540000}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{E369A160-F3C2-11D0-91D4-444553540000}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{E369A160-F3C2-11D0-91D4-444553540000}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\Interface\\{665A4447-D905-11D0-A30E-444553540000}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\Interface\\{665A4447-D905-11D0-A30E-444553540000}\\ProxyStubClsid\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\Interface\\{665A4447-D905-11D0-A30E-444553540000}\\ProxyStubClsid32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\Interface\\{665A4447-D905-11D0-A30E-444553540000}\\TypeLib\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\Interface\\{665A4449-D905-11D0-A30E-444553540000}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\Interface\\{665A4449-D905-11D0-A30E-444553540000}\\ProxyStubClsid\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\Interface\\{665A4449-D905-11D0-A30E-444553540000}\\ProxyStubClsid32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\Interface\\{665A4449-D905-11D0-A30E-444553540000}\\TypeLib\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\TypeLib\\{665A4446-D905-11D0-A30E-444553540000}\\1.0\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\TypeLib\\{665A4446-D905-11D0-A30E-444553540000}\\1.0\\0\\win32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\TypeLib\\{665A4446-D905-11D0-A30E-444553540000}\\1.0\\FLAGS\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\TypeLib\\{665A4446-D905-11D0-A30E-444553540000}\\1.0\\HELPDIR\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCU\\Software\\Classes\\iTunes.BurnCD\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\iTunes.BurnCD\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCU\\Software\\Classes\\MIME\\Database\\Content Type\\application/x-itunes-itms\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\MIME\\Database\\Content Type\\application/x-itunes-itms\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCU\\Software\\Classes\\MIME\\Database\\Content Type\\application/x-itunes-itpc\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\MIME\\Database\\Content Type\\application/x-itunes-itpc\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCU\\Software\\Classes\\MIME\\Database\\Content Type\\application/x-podcast\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\MIME\\Database\\Content Type\\application/x-podcast\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SYSTEM\\ControlSet001\\Control\\ProductOptions\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SYSTEM\\ControlSet002\\Control\\ProductOptions\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SYSTEM\\ControlSet003\\Control\\ProductOptions\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SYSTEM\\CurrentControlSet\\Control\\ProductOptions\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\chm.file\\shell\\open\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\software\\microsoft\\IE Setup\\SETUP\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\software\\microsoft\\Windows NT\\CurrentVersion\\Hotfix\\\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SYSTEM\\WPA\\MediaCenter\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\software\\microsoft\\Outlook Express\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Microsoft\\Direct3D\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Microsoft\\DirectDraw\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\ThemeManager\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Microsoft\\WAB\\DLLPath\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCU\\Software\\Microsoft\\Direct3D\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Microsoft\\Internet Explorer\\Version Vector\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Microsoft\\NET Framework Setup\\NDP\\v4\\Client\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Microsoft\\NET Framework Setup\\NDP\\v4\\Full\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Macromedia\\FlashPlayerActiveY_BOGUSKEY\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Macromedia\\FlashPlayerActiveX\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{031E4825-7B94-4dc3-B131-E946B44C8DD5}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Wow6432Node\\Microsoft\\NET Framework Setup\\NDP\\v4\\Client\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Wow6432Node\\Microsoft\\NET Framework Setup\\NDP\\v4\\Full\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Wow6432Node\\Microsoft\\Internet Explorer\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Controls Folder\\Desk\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Controls Folder\\Display\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\System\\CurrentControlSet\\Control\\Class\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\System\\CurrentControlSet\\Services\\Class\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\System\\CurrentControlSet\\Control\\Class\\{4D36E968-E325-11CE-BFC1-08002BE10318}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\System\\CurrentControlSet\\Services\\Class\\Display\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Cache\\Special Paths\\Cookies\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Hasbro Interactive\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SYSTEM\\CurrentControlSet\\Enum\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Enum\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SYSTEM\\CurrentControlSet\\Enum\\PCI\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCC\\Software\\Fonts\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"System\\CurrentControlSet\\Control\\Nls\\Locale\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\WORDPAD.EXE\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\rtffile\\shell\\open\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\rtffile\\shell\\print\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\rtffile\\shell\\printto\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\Wordpad.Document.1\\shell\\open\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\Wordpad.Document.1\\shell\\print\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\Wordpad.Document.1\\shell\\printto\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\wrifile\\shell\\open\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\wrifile\\shell\\print\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\wrifile\\shell\\printto\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Classes\\Applications\\wordpad.exe\\shell\\open\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Classes\\Applications\\wordpad.exe\\shell\\print\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Classes\\Applications\\wordpad.exe\\shell\\printto\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Classes\\rtffile\\shell\\open\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Classes\\rtffile\\shell\\print\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Classes\\rtffile\\shell\\printto\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Classes\\Wordpad.Document.1\\shell\\open\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Classes\\Wordpad.Document.1\\shell\\print\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Classes\\Wordpad.Document.1\\shell\\printto\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Classes\\wrifile\\shell\\open\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Classes\\wrifile\\shell\\print\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Classes\\wrifile\\shell\\printto\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Setup\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"System\\CurrentControlSet\\Services\\NetBT\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows NT\\CurrentVersion\\NetworkCards\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\System\\CurrentControlSet\\Control\\Windows\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Applications\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Microsoft\\DirectX\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\DXDIAG.EXE\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Electronic Arts\\Future Cop\\Settings\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows NT\\CurrentVersion\\Drivers32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\System\\CurrentControlSet\\Control\\MediaResources\\ACM\\MSACM.MSADPCM\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Microsoft\\Windows\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCU\\Software\\Microsoft\\Windows\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\FirstByte\\ProVoice\\SpeechFonts\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Microsoft\\Internet Explorer\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"System\\CurrentControlSet\\Control\\MediaProperties\\PrivateProperties\\Joystick\\OEM\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCU\\Software\\Adobe\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Adobe\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Adobe\\PageMaker65\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCU\\Software\\Adobe\\PageMaker65\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCU\\Software\\Caere Corp\\PageKeepPro30\\Preference\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Caere Corp\\Scan Manager\\4.02\\Scanners\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SYSTEM\\CurrentControlSet\\Enum\\Root\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\Components\\359E92CC2CB71D119A12000A9CE1A22A\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\System\\CurrentControlSet\\Services\\W3SVC\\Parameters\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\System\\CurrentControlSet\\Control\\MediaResources\\DirectSound\\Application Compatibility\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Windows File Protection\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\HKEY_CURRENT_USER\\Software\\Classes\\\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Volatile\\00\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy\" in Source: 00000000-00007376.00000000.113264.73451000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00007376.00000000.113264.74841000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa\" in Source: 00000000-00007376.00000000.113264.73451000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00007376.00000000.113264.74841000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Accent\" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Policies\\Microsoft\\Windows\\Personalization\" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\DWM\" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\ImmersiveShell\" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\ThemeManager\" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\DiagnosticAnimationXML\" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00007376.00000000.113264.746E1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\".Default\\Software\\Microsoft\\Windows\\CurrentVersion\\ThemeManager\" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Themes\\History\\Colors\" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Themes\\History\" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Accents\" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Wisp\\Touch\" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00007376.00000000.113264.77110000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Software\\Classes\\CLSID\\\" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\Software\\Microsoft\\Windows\\CurrentVersion\" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Layers\" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\InstalledSDB\" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00007376.00000000.113264.77110000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Custom\" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Disable8And16BitMitigation\" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp"}],"origin":"File/Memory","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-91","type":0,"relevance":1,"name":"DLL with no export directory","description":"\"x.exe\" has no export directory \"IMAGE_DIRECTORY_ENTRY_EXPORT\"","description_v2":["\"x.exe\" has no export directory \"IMAGE_DIRECTORY_ENTRY_EXPORT\""],"description_v3":[{"type":"text","value":"\"x.exe\" has no export directory \"IMAGE_DIRECTORY_ENTRY_EXPORT\""}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"target-329","type":9,"relevance":1,"name":"Executes a DLL using Regsvr32 process","description":"Process \"regsvr32.exe\" with commandline \"/s \"C:\\\\x.exe.dll\"\" (UID: 00000000-00007376)","description_v2":["Process \"regsvr32.exe\" with commandline \"/s \"C:\\\\x.exe.dll\"\" (UID: 00000000-00007376)"],"description_v3":[{"type":"text","value":"Process \"regsvr32.exe\" with commandline \"/s \"C:\\\\x.exe.dll\"\""},{"type":"process","process_uid":"00000000-00007376","label":"Show Process"}],"origin":"Monitored Target","attck_id":"T1218.010","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1218/010","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-154","type":0,"relevance":0,"name":"File contains dynamic base/NX flags","description":"\"x.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","description_v2":["\"x.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE","IMAGE_DLLCHARACTERISTICS_NX_COMPAT","IMAGE_DLLCHARACTERISTICS_NO_SEH","IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE"],"description_v3":[{"type":"text","value":"\"x.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE"},{"type":"linebreak"},{"type":"text","value":"IMAGE_DLLCHARACTERISTICS_NX_COMPAT"},{"type":"linebreak"},{"type":"text","value":"IMAGE_DLLCHARACTERISTICS_NO_SEH"},{"type":"linebreak"},{"type":"text","value":"IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE"}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"memorydump-10","type":20,"relevance":1,"name":"Found registry location strings in memory","description":"$9c","description_v2":["\"SOFTWARE\\Microsoft\\Cryptography\\Defaults\\Provider\" in Source: 00000000-00007376.00000000.113264.72F31000.00000020.mdmp","\"SOFTWARE\\Microsoft\\Cryptography\\Defaults\\Provider\\\" in Source: 00000000-00007376.00000000.113264.72F31000.00000020.mdmp","\"SOFTWARE\\Microsoft\\Cryptography\\Defaults\\Provider Types\\Type \" in Source: 00000000-00007376.00000000.113264.72F31000.00000020.mdmp","\"SOFTWARE\\Microsoft\\Cryptography\\Defaults\\Provider Types\" in Source: 00000000-00007376.00000000.113264.72F31000.00000020.mdmp","\"SOFTWARE\\Microsoft\\Cryptography\\Providers\\Type \" in Source: 00000000-00007376.00000000.113264.72F31000.00000020.mdmp","\"SOFTWARE\\Microsoft\\SystemCertificates\\Root\\Certificates\\2BD63D28D7BCD0E251195AEB519243C13142EBC3\" in Source: 00000000-00007376.00000000.113264.72F31000.00000020.mdmp","\"SOFTWARE\\Microsoft\\SystemCertificates\\Root\\Certificates\\8A334AA8052DD244A647306A76B8178FA215F344\" in Source: 00000000-00007376.00000000.113264.72F31000.00000020.mdmp","\"SYSTEM\\CurrentControlSet\\Control\\Print\" in Source: 00000000-00007376.00000000.113264.73051000.00000020.mdmp","\"System\\CurrentControlSet\\Control\\Print\" in Source: 00000000-00007376.00000000.113264.73051000.00000020.mdmp","\"Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\" in Source: 00000000-00007376.00000000.113264.73051000.00000020.mdmp","\"Software\\Microsoft\\Windows NT\\CurrentVersion\\Devices\" in Source: 00000000-00007376.00000000.113264.73051000.00000020.mdmp","\"System\\CurrentControlSet\\Control\\Print\\Environments\" in Source: 00000000-00007376.00000000.113264.73051000.00000020.mdmp","\"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Perflib\" in Source: 00000000-00007376.00000000.113264.73051000.00000020.mdmp","\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"SOFTWARE\\CLASSES\\PACKAGEDCOM\\PACKAGE\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"SOFTWARE\\Microsoft\\Office\\16.0\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"SOFTWARE\\Wow6432Node\\Microsoft\\Office\\16.0\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\App Paths\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCU\\%s\\COMMON\\GENERAL\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\%s\\COMMON\\InstallRoot\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCU\\%s\\%s\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\%s\\%s\\InstallRoot\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCU\\SOFTWARE\\Classes\\%s.Application\\CurVer\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCU\\SOFTWARE\\Classes\\%s.Application.%s\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\%s.Application\\CurVer\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\%s.Application.%s\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\%s.Application\\CurVer\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\%s.Application.%s\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\%s\\%s\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\%s\\LocalServer\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\%s\\LocalServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\%s\\LocalServer\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\%s\\LocalServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\WOW6432Node\\CLSID\\%s\\LocalServer\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\WOW6432Node\\CLSID\\%s\\LocalServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"\\Registry\\Machine\\Software\\Classes\\\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"\\REGISTRY\\MACHINE\\SOFTWARE\\WOW6432Node\\\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"\\REGISTRY\\MACHINE\\SOFTWARE\\WOW6432Node\\Classes\\\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"\\Registry\\Machine\\System\\ControlSet001\\\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"System\\CurrentControlSet\\Control\\Session Manager\\Environment\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\Excel.Application\\CLSID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\Implemented Categories\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\Implemented Categories\\{000C0118-0000-0000-C000-000000000046}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\InprocHandler32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\InprocServer32\\15.0.0.0\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\LocalServer\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\LocalServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\ProgID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\VersionIndependentProgID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\Excel.Application\\CLSID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\Implemented Categories\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\Implemented Categories\\{000C0118-0000-0000-C000-000000000046}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\InprocHandler32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\InprocServer32\\15.0.0.0\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\LocalServer\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\LocalServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\ProgID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\VersionIndependentProgID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\Outlook.Application\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\Outlook.Application\\CLSID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCU\\SOFTWARE\\Classes\\Outlook.Application\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCU\\SOFTWARE\\Classes\\Outlook.Application\\CLSID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\Interface\\{00063001-0000-0000-C000-000000000046}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\Interface\\{00063001-0000-0000-C000-000000000046}\\ProxyStubClsid\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\Interface\\{00063001-0000-0000-C000-000000000046}\\ProxyStubClsid32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\Interface\\{00063001-0000-0000-C000-000000000046}\\TypeLib\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\Interface\\{00063001-0000-0000-C000-000000000046}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\Interface\\{00063001-0000-0000-C000-000000000046}\\ProxyStubClsid\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\Interface\\{00063001-0000-0000-C000-000000000046}\\ProxyStubClsid32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\Interface\\{00063001-0000-0000-C000-000000000046}\\TypeLib\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCU\\SOFTWARE\\Classes\\Interface\\{00063001-0000-0000-C000-000000000046}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCU\\SOFTWARE\\Classes\\Interface\\{00063001-0000-0000-C000-000000000046}\\ProxyStubClsid\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCU\\SOFTWARE\\Classes\\Interface\\{00063001-0000-0000-C000-000000000046}\\ProxyStubClsid32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCU\\SOFTWARE\\Classes\\Interface\\{00063001-0000-0000-C000-000000000046}\\TypeLib\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Microsoft\\Office\\16.0\\Outlook\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\WOW6432Node\\Microsoft\\Office\\16.0\\Outlook\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Clients\\Mail\\Microsoft Outlook\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\InprocServer32\\15.0.0.0\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\PowerPoint.Application\\CLSID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\InprocHandler\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\InprocHandler32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\InprocServer32\\15.0.0.0\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\LocalServer\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\LocalServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\ProgID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\VersionIndependentProgID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\InprocServer32\\15.0.0.0\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\PowerPoint.Application\\CLSID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\InprocHandler\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\InprocHandler32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\InprocServer32\\15.0.0.0\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\LocalServer\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\LocalServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\ProgID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\VersionIndependentProgID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\Word.Application\\CLSID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\WOW6432Node\\CLSID\\{000209FF-0000-0000-C000-000000000046}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\WOW6432Node\\CLSID\\{000209FF-0000-0000-C000-000000000046}\\InprocHandler32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\WOW6432Node\\CLSID\\{000209FF-0000-0000-C000-000000000046}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\WOW6432Node\\CLSID\\{000209FF-0000-0000-C000-000000000046}\\InprocServer32\\15.0.0.0\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\WOW6432Node\\CLSID\\{000209FF-0000-0000-C000-000000000046}\\LocalServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\WOW6432Node\\CLSID\\{000209FF-0000-0000-C000-000000000046}\\ProgID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\WOW6432Node\\CLSID\\{000209FF-0000-0000-C000-000000000046}\\VersionIndependentProgID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\Word.Application\\CLSID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{000209FF-0000-0000-C000-000000000046}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{000209FF-0000-0000-C000-000000000046}\\InprocHandler32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{000209FF-0000-0000-C000-000000000046}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{000209FF-0000-0000-C000-000000000046}\\InprocServer32\\15.0.0.0\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{000209FF-0000-0000-C000-000000000046}\\LocalServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{000209FF-0000-0000-C000-000000000046}\\ProgID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{000209FF-0000-0000-C000-000000000046}\\VersionIndependentProgID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"System\\CurrentControlSet\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"SOFTWARE\\Classes\\CLSID\\%ls\\LocalServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"SOFTWARE\\Classes\\CLSID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCU\\Software\\Classes\\\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"Software\\Classes\\\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCC\\System\\CurrentControlSet\\Control\\Print\\Printers\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Microsoft\\Direct3D\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"Software\\Classes\\Body5\\Open\\Shell\\Command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Encore Software\\Middle School Advantage 2001\\1.0\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\nowcom\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCU\\Software\\nowcom\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\nowirc\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCU\\Software\\nowirc\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\nownuri\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCU\\Software\\nownuri\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"Software\\Microsoft\\Windows NT\\CurrentVersion\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Microsoft\\MSN\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\MSN\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Config\\0001\\Display\\Settings\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"System\\CurrentControlSet\\Enum\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\System\\CurrentControlSet\\Enum\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCU\\Software\\Microsoft\\CTF\\LangBar\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\ODBC\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\System\\CurrentControlSet\\services\\W3svc\\Parameters\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Microsoft\\Outlook Express\\Inetcomm\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Microsoft\\Outlook Express\\Version Info\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Memory Management\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Memory Management\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{083863F1-70DE-11D0-BD40-00A0C911CE86}\\Instance\\{4CB63E61-C611-11D0-83AA-000092900184}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{4CB63E61-C611-11D0-83AA-000092900184}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{4CB63E61-C611-11D0-83AA-000092900184}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{4CB63E62-C611-11D0-83AA-000092900184}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{4CB63E62-C611-11D0-83AA-000092900184}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{083863F1-70DE-11D0-BD40-00A0C911CE86}\\Instance\\{B4CA2970-DD2B-11D0-9DFA-00AA00AF3494}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{B4CA2970-DD2B-11D0-9DFA-00AA00AF3494}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{B4CA2970-DD2B-11D0-9DFA-00AA00AF3494}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{B4CA2971-DD2B-11D0-9DFA-00AA00AF3494}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{B4CA2971-DD2B-11D0-9DFA-00AA00AF3494}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{C83B5610-E0DF-11D0-9E00-00AA00AF3494}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{C83B5610-E0DF-11D0-9E00-00AA00AF3494}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\drivers.desc\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Drivers32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\System\\CurrentControlSet\\Control\\MediaProperties\\PrivateProperties\\Joystick\\Winmm\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{31345649-0000-0010-8000-00AA00389B71}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{31345649-0000-0010-8000-00AA00389B71}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{31345649-0000-0010-8000-00AA00389B71}\\Pins\\Input\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{31345649-0000-0010-8000-00AA00389B71}\\Pins\\Input\\Types\\{73646976-0000-0010-8000-00AA00389B71}\\{31345649-0000-0010-8000-00AA00389B71}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{31345649-0000-0010-8000-00AA00389B71}\\Pins\\Output\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{31345649-0000-0010-8000-00AA00389B71}\\Pins\\Output\\Types\\{73646976-0000-0010-8000-00AA00389B71}\\{00000000-0000-0000-0000-000000000000}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{87CA6F02-49E4-11CF-A3FE-00AA003735BE}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{87CA6F02-49E4-11CF-A3FE-00AA003735BE}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{87CA6F04-49E4-11CF-A3FE-00AA003735BE}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{87CA6F04-49E4-11CF-A3FE-00AA003735BE}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{A2551F60-705F-11CF-A424-00AA003735BE}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{A2551F60-705F-11CF-A424-00AA003735BE}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{A2551F60-705F-11CF-A424-00AA003735BE}\\Pins\\Input\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{A2551F60-705F-11CF-A424-00AA003735BE}\\Pins\\Input\\Types\\{73646976-0000-0010-8000-00AA00389B71}\\{00000000-0000-0000-0000-000000000000}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{A2551F60-705F-11CF-A424-00AA003735BE}\\Pins\\Output\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{A2551F60-705F-11CF-A424-00AA003735BE}\\Pins\\Output\\Types\\{73646976-0000-0010-8000-00AA00389B71}\\{31345649-0000-0010-8000-00AA00389B71}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{BD323430-CE94-11CE-82DD-0800095A5B55}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{BD323430-CE94-11CE-82DD-0800095A5B55}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{BD323431-CE94-11CE-82DD-0800095A5B55}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{BD323431-CE94-11CE-82DD-0800095A5B55}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{BD323432-CE94-11CE-82DD-0800095A5B55}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{BD323432-CE94-11CE-82DD-0800095A5B55}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{BD323433-CE94-11CE-82DD-0800095A5B55}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{BD323433-CE94-11CE-82DD-0800095A5B55}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\Filter\\{31345649-0000-0010-8000-00AA00389B71}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\Filter\\{A2551F60-705F-11CF-A424-00AA003735BE}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCU\\Software\\Intel\\Indeo\\4.1\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{083863F1-70DE-11D0-BD40-00A0C911CE86}\\Instance\\{1F73E9B1-8C3A-11D0-A3BE-00A0C9244436}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{083863F1-70DE-11D0-BD40-00A0C911CE86}\\Instance\\{30355649-0000-0010-8000-00AA00389B71}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{1F73E9B1-8C3A-11D0-A3BE-00A0C9244436}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{1F73E9B1-8C3A-11D0-A3BE-00A0C9244436}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{2DE89781-DBF6-11D0-A30E-444553540000}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{2DE89781-DBF6-11D0-A30E-444553540000}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{30355649-0000-0010-8000-00AA00389B71}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{30355649-0000-0010-8000-00AA00389B71}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{33D9A760-90C8-11D0-BD43-00A0C911CE86}\\Instance\\Indeo\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{665A4443-D905-11D0-A30E-444553540000}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{665A4443-D905-11D0-A30E-444553540000}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{665A4444-D905-11D0-A30E-444553540000}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{665A4444-D905-11D0-A30E-444553540000}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{665A4445-D905-11D0-A30E-444553540000}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{665A4445-D905-11D0-A30E-444553540000}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{665A4448-D905-11D0-A30E-444553540000}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{665A4448-D905-11D0-A30E-444553540000}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{665A444A-D905-11D0-A30E-444553540000}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{665A444A-D905-11D0-A30E-444553540000}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{84725EA1-2FBC-11D1-BC86-00A0C969FC67}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{84725EA1-2FBC-11D1-BC86-00A0C969FC67}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{C1C0FE00-F3C2-11D0-91D4-444553540000}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{C1C0FE00-F3C2-11D0-91D4-444553540000}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{E369A160-F3C2-11D0-91D4-444553540000}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{E369A160-F3C2-11D0-91D4-444553540000}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\Interface\\{665A4447-D905-11D0-A30E-444553540000}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\Interface\\{665A4447-D905-11D0-A30E-444553540000}\\ProxyStubClsid\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\Interface\\{665A4447-D905-11D0-A30E-444553540000}\\ProxyStubClsid32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\Interface\\{665A4447-D905-11D0-A30E-444553540000}\\TypeLib\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\Interface\\{665A4449-D905-11D0-A30E-444553540000}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\Interface\\{665A4449-D905-11D0-A30E-444553540000}\\ProxyStubClsid\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\Interface\\{665A4449-D905-11D0-A30E-444553540000}\\ProxyStubClsid32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\Interface\\{665A4449-D905-11D0-A30E-444553540000}\\TypeLib\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\TypeLib\\{665A4446-D905-11D0-A30E-444553540000}\\1.0\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\TypeLib\\{665A4446-D905-11D0-A30E-444553540000}\\1.0\\0\\win32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\TypeLib\\{665A4446-D905-11D0-A30E-444553540000}\\1.0\\FLAGS\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\TypeLib\\{665A4446-D905-11D0-A30E-444553540000}\\1.0\\HELPDIR\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCU\\Software\\Classes\\iTunes.BurnCD\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\iTunes.BurnCD\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCU\\Software\\Classes\\MIME\\Database\\Content Type\\application/x-itunes-itms\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\MIME\\Database\\Content Type\\application/x-itunes-itms\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCU\\Software\\Classes\\MIME\\Database\\Content Type\\application/x-itunes-itpc\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\MIME\\Database\\Content Type\\application/x-itunes-itpc\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCU\\Software\\Classes\\MIME\\Database\\Content Type\\application/x-podcast\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\MIME\\Database\\Content Type\\application/x-podcast\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SYSTEM\\ControlSet001\\Control\\ProductOptions\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SYSTEM\\ControlSet002\\Control\\ProductOptions\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SYSTEM\\ControlSet003\\Control\\ProductOptions\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SYSTEM\\CurrentControlSet\\Control\\ProductOptions\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\chm.file\\shell\\open\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\software\\microsoft\\IE Setup\\SETUP\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\software\\microsoft\\Windows NT\\CurrentVersion\\Hotfix\\ \" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SYSTEM\\WPA\\MediaCenter\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\software\\microsoft\\Outlook Express\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Microsoft\\Direct3D\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Microsoft\\DirectDraw\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\ThemeManager\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Microsoft\\WAB\\DLLPath\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCU\\Software\\Microsoft\\Direct3D\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Microsoft\\Internet Explorer\\Version Vector\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Microsoft\\NET Framework Setup\\NDP\\v4\\Client\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Microsoft\\NET Framework Setup\\NDP\\v4\\Full\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Macromedia\\FlashPlayerActiveY_BOGUSKEY\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Macromedia\\FlashPlayerActiveX\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\CLSID\\{031E4825-7B94-4dc3-B131-E946B44C8DD5}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Wow6432Node\\Microsoft\\NET Framework Setup\\NDP\\v4\\Client\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Wow6432Node\\Microsoft\\NET Framework Setup\\NDP\\v4\\Full\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Wow6432Node\\Microsoft\\Internet Explorer\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Controls Folder\\Desk\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Controls Folder\\Display\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\System\\CurrentControlSet\\Control\\Class\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\System\\CurrentControlSet\\Services\\Class\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\System\\CurrentControlSet\\Control\\Class\\{4D36E968-E325-11CE-BFC1-08002BE10318}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\System\\CurrentControlSet\\Services\\Class\\Display\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Cache\\Special Paths\\Cookies\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"SOFTWARE\\Hasbro Interactive\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SYSTEM\\CurrentControlSet\\Enum\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Enum\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"SYSTEM\\CurrentControlSet\\Enum\\PCI\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCC\\Software\\Fonts\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"System\\CurrentControlSet\\Control\\Nls\\Locale\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\WORDPAD.EXE\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\rtffile\\shell\\open\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\rtffile\\shell\\print\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\rtffile\\shell\\printto\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\Wordpad.Document.1\\shell\\open\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\Wordpad.Document.1\\shell\\print\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\Wordpad.Document.1\\shell\\printto\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\wrifile\\shell\\open\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\wrifile\\shell\\print\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCR\\wrifile\\shell\\printto\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Classes\\Applications\\wordpad.exe\\shell\\open\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Classes\\Applications\\wordpad.exe\\shell\\print\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Classes\\Applications\\wordpad.exe\\shell\\printto\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Classes\\rtffile\\shell\\open\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Classes\\rtffile\\shell\\print\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Classes\\rtffile\\shell\\printto\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Classes\\Wordpad.Document.1\\shell\\open\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Classes\\Wordpad.Document.1\\shell\\print\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Classes\\Wordpad.Document.1\\shell\\printto\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Classes\\wrifile\\shell\\open\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Classes\\wrifile\\shell\\print\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Classes\\wrifile\\shell\\printto\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Setup\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"System\\CurrentControlSet\\Services\\NetBT\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"Software\\Microsoft\\Windows NT\\CurrentVersion\\NetworkCards\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\System\\CurrentControlSet\\Control\\Windows\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Applications\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Microsoft\\DirectX\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\DXDIAG.EXE\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Electronic Arts\\Future Cop\\Settings\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"Software\\Microsoft\\Windows NT\\CurrentVersion\\Drivers32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\System\\CurrentControlSet\\Control\\MediaResources\\ACM\\MSACM.MSADPCM\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Microsoft\\Windows\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCU\\Software\\Microsoft\\Windows\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"Software\\FirstByte\\ProVoice\\SpeechFonts\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Microsoft\\Internet Explorer\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"System\\CurrentControlSet\\Control\\MediaProperties\\PrivateProperties\\Joystick\\OEM\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCU\\Software\\Adobe\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Adobe\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\Software\\Adobe\\PageMaker65\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCU\\Software\\Adobe\\PageMaker65\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKCU\\Software\\Caere Corp\\PageKeepPro30\\Preference\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"Software\\Caere Corp\\Scan Manager\\4.02\\Scanners\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SYSTEM\\CurrentControlSet\\Enum\\Root\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\Components\\359E92CC2CB71D119A12000A9CE1A22A\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\System\\CurrentControlSet\\Services\\W3SVC\\Parameters\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"HKLM\\System\\CurrentControlSet\\Control\\MediaResources\\DirectSound\\Application Compatibility\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"\\Registry\\Machine\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Windows File Protection\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"\\Registry\\HKEY_CURRENT_USER\\Software\\Classes\\\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"Software\\Volatile\\00\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp","\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy\" in Source: 00000000-00007376.00000000.113264.73451000.00000020.mdmp","\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa\" in Source: 00000000-00007376.00000000.113264.73451000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Accent\" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp","\"Software\\Policies\\Microsoft\\Windows\\Personalization\" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp","\"Software\\Microsoft\\Windows\\DWM\" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\ImmersiveShell\" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\ThemeManager\" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp","\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp","\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\DiagnosticAnimationXML\" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp","\".Default\\Software\\Microsoft\\Windows\\CurrentVersion\\ThemeManager\" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\Themes\\History\\Colors\" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\Themes\\History\" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp","\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Accents\" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp","\"Software\\Microsoft\\Wisp\\Touch\" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp","\"\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp","\"\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp","\"\\Software\\Classes\\CLSID\\\" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp","\"\\Registry\\Machine\\Software\\Microsoft\\Windows\\CurrentVersion\" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp","\"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp","\"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp","\"\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Layers\" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp","\"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\InstalledSDB\" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp","\"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Custom\" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp","\"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Disable8And16BitMitigation\" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp","\"SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp","\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp","\"\\Registry\\Machine\\Software\\Microsoft\\Wow64\\\" in Source: 00000000-00007376.00000000.113264.74624000.00000002.mdmp","\"\\REGISTRY\\MACHINE\\SOFTWARE\\Wow6432Node\" in Source: 00000000-00007376.00000000.113264.74624000.00000002.mdmp","\"\\REGISTRY\\USER\\*\\SOFTWARE\\Classes\" in Source: 00000000-00007376.00000000.113264.74624000.00000002.mdmp","\"\\REGISTRY\\USER\\*\\SOFTWARE\\Classes\\Wow6432Node\" in Source: 00000000-00007376.00000000.113264.74624000.00000002.mdmp","\"system\\CurrentControlSet\\Control\\NetworkProvider\" in Source: 00000000-00007376.00000000.113264.746E1000.00000020.mdmp","\"system\\CurrentControlSet\\control\\NetworkProvider\\ProviderOrder\" in Source: 00000000-00007376.00000000.113264.746E1000.00000020.mdmp","\"system\\CurrentControlSet\\control\\NetworkProvider\\HwOrder\" in Source: 00000000-00007376.00000000.113264.746E1000.00000020.mdmp","\"system\\CurrentControlSet\" in Source: 00000000-00007376.00000000.113264.746E1000.00000020.mdmp","\"system\\CurrentControlSet\\Control\\NetworkProvider\\Notifyees\" in Source: 00000000-00007376.00000000.113264.746E1000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" in Source: 00000000-00007376.00000000.113264.746E1000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Network\" in Source: 00000000-00007376.00000000.113264.746E1000.00000020.mdmp","\"SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters\\Interfaces\\\" in Source: 00000000-00007376.00000000.113264.74701000.00000020.mdmp","\"SYSTEM\\CurrentControlSet\\Services\\Tcpip6\\Parameters\\Interfaces\\\" in Source: 00000000-00007376.00000000.113264.74701000.00000020.mdmp","\"SYSTEM\\CurrentControlSet\\Services\\NetBT\\Parameters\" in Source: 00000000-00007376.00000000.113264.74701000.00000020.mdmp","\"System\\CurrentControlSet\\Services\\NcbService\\NCB\" in Source: 00000000-00007376.00000000.113264.74701000.00000020.mdmp","\"Software\\Microsoft\\wcmsvc\\wifinetworkmanager\\config\" in Source: 00000000-00007376.00000000.113264.74701000.00000020.mdmp","\"SYSTEM\\CurrentControlSet\\Control\\Lsa\\MSV1_0\" in Source: 00000000-00007376.00000000.113264.74741000.00000020.mdmp","\"System\\CurrentControlSet\\Control\\SecurityProviders\" in Source: 00000000-00007376.00000000.113264.74741000.00000020.mdmp","\"System\\CurrentControlSet\\Control\\Lsa\\SspiCache\" in Source: 00000000-00007376.00000000.113264.74741000.00000020.mdmp","\"System\\CurrentControlSet\\Control\\SecurityProviders\\SaslProfiles\" in Source: 00000000-00007376.00000000.113264.74741000.00000020.mdmp","\"System\\CurrentControlSet\\Control\\Lsa\" in Source: 00000000-00007376.00000000.113264.74741000.00000020.mdmp","\"System\\CurrentControlSet\\Control\\Hvsi\" in Source: 00000000-00007376.00000000.113264.74741000.00000020.mdmp","\"SYSTEM\\CurrentControlSet\\Services\\Netlogon\\Parameters\\GpParameters\" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp","\"SYSTEM\\CurrentControlSet\\Services\\Netlogon\\Parameters\" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp","\"\\Registry\\Machine\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Perflib\" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp","\"\\REGISTRY\\MACHINE\\SYSTEM\\CurrentControlSet\\Services\" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp","\"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Perflib\" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp","\"Software\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp","\"\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows\\Safer\" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp","\"\\Software\\Policies\\Microsoft\\Windows\\Safer\" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp","\"System\\CurrentControlSet\\Control\\IDConfigDB\" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp","\"\\Registry\\Machine\\Software\\Classes\" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp","\"System\\CurrentControlSet\\Control\\LSA\\AccessProviders\" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp","\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Srp\\GP\\\" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp","\"\\Registry\\MACHINE\\System\\CurrentControlSet\\Control\\SafeBoot\\Option\" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp","\"\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\Group Policy\\Appmgmt\" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp","\"Software\\Microsoft\\Windows NT\\CurrentVersion\\Diagnostics\" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp","\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\SrpExtensionConfig\" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp","\"%HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRoot%\" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp","\"%HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ProgramFilesDir%\" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp","\"System\\CurrentControlSet\\Services\\\" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp","\"\\REGISTRY\\MACHINE\\SOFTWARE\\CLASSES\" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp","\"Software\\Classes\\\" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp","\"SYSTEM\\CurrentControlSet\\Control\\Lsa\" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp","\"SYSTEM\\CurrentControlSet\\Control\\DevQuery\" in Source: 00000000-00007376.00000000.113264.74801000.00000020.mdmp","\"SYSTEM\\CurrentControlSet\\Services\\DeviceInstall\\Parameters\" in Source: 00000000-00007376.00000000.113264.74801000.00000020.mdmp","\"SYSTEM\\CurrentControlSet\\Services\\DeviceInstall\" in Source: 00000000-00007376.00000000.113264.74801000.00000020.mdmp","\"System\\CurrentControlSet\\Control\\IDConfigDB\" in Source: 00000000-00007376.00000000.113264.74801000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\Setup\" in Source: 00000000-00007376.00000000.113264.74801000.00000020.mdmp","\"\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\" in Source: 00000000-00007376.00000000.113264.74801000.00000020.mdmp","\"\\REGISTRY\\MACHINE\\SYSTEM\\CurrentControlSet\\Hardware Profiles\\Current\" in Source: 00000000-00007376.00000000.113264.74801000.00000020.mdmp","\"SYSTEM\\CurrentControlSet\\Control\\Cryptography\\ECCParameters\" in Source: 00000000-00007376.00000000.113264.74841000.00000020.mdmp","\"\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Policies\\Microsoft\\Cryptography\\Configuration\" in Source: 00000000-00007376.00000000.113264.74841000.00000020.mdmp","\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa\" in Source: 00000000-00007376.00000000.113264.74841000.00000020.mdmp","\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy\" in Source: 00000000-00007376.00000000.113264.74841000.00000020.mdmp","\"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\" in Source: 00000000-00007376.00000000.113264.749F1000.00000020.mdmp","\"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\" in Source: 00000000-00007376.00000000.113264.749F1000.00000020.mdmp","\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Keyboard Layout\" in Source: 00000000-00007376.00000000.113264.749F1000.00000020.mdmp","\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Keyboard Layout\\\" in Source: 00000000-00007376.00000000.113264.749F1000.00000020.mdmp","\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Keyboard Layouts\\\" in Source: 00000000-00007376.00000000.113264.749F1000.00000020.mdmp","\"\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows\\Display\" in Source: 00000000-00007376.00000000.113264.749F1000.00000020.mdmp","\"\\Registry\\Machine\\Software\\Microsoft\\Windows\\Tablet PC\\\" in Source: 00000000-00007376.00000000.113264.749F1000.00000020.mdmp","\"\\Registry\\Machine\\Software\\Microsoft\\Windows\\CurrentVersion\\Media Center\\\" in Source: 00000000-00007376.00000000.113264.749F1000.00000020.mdmp","\"Software\\Policies\\Microsoft\\Windows NT\\Reliability\" in Source: 00000000-00007376.00000000.113264.749F1000.00000020.mdmp","\"\\Registry\\Machine\\Software\\Microsoft\\Windows\\CurrentVersion\\ImmersiveShell\\\" in Source: 00000000-00007376.00000000.113264.749F1000.00000020.mdmp","\"System\\CurrentControlSet\\Services\" in Source: 00000000-00007376.00000000.113264.74B71000.00000020.mdmp","\"SYSTEM\\CurrentControlSet\\Services\\Netlogon\\Parameters\\GpParameters\" in Source: 00000000-00007376.00000000.113264.74B71000.00000020.mdmp","\"SYSTEM\\CurrentControlSet\\Services\\Netlogon\\Parameters\" in Source: 00000000-00007376.00000000.113264.74B71000.00000020.mdmp","\"Software\\Microsoft\\IdentityStore\\Providers\" in Source: 00000000-00007376.00000000.113264.74B71000.00000020.mdmp","\"\\REGISTRY\\MACHINE\\Software\\Microsoft\\SecurityManager\\TransientObjects\\\" in Source: 00000000-00007376.00000000.113264.74B71000.00000020.mdmp","\"System\\CurrentControlSet\\Control\\SQMServiceList\" in Source: 00000000-00007376.00000000.113264.74B71000.00000020.mdmp","\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\MiniNT\" in Source: 00000000-00007376.00000000.113264.74B71000.00000020.mdmp","\"System\\CurrentControlSet\\Control\" in Source: 00000000-00007376.00000000.113264.74B71000.00000020.mdmp","\"SYSTEM\\CurrentControlSet\\Control\\WMI\\Security\" in Source: 00000000-00007376.00000000.113264.74B71000.00000020.mdmp","\"SYSTEM\\CurrentControlSet\\Control\\Lsa\" in Source: 00000000-00007376.00000000.113264.74B71000.00000020.mdmp","\"System\\CurrentControlSet\\Services\\WinSock2\\Parameters\" in Source: 00000000-00007376.00000000.113264.74BC1000.00000020.mdmp","\"System\\CurrentControlSet\\Services\\Winsock2\\Parameters\" in Source: 00000000-00007376.00000000.113264.74BC1000.00000020.mdmp","\"System\\CurrentControlSet\\Services\\Tcpip\\Parameters\" in Source: 00000000-00007376.00000000.113264.74BC1000.00000020.mdmp","\"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\WinSock2\\Parameters\" in Source: 00000000-00007376.00000000.113264.74BC1000.00000020.mdmp","\"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\WS2IFSL\" in Source: 00000000-00007376.00000000.113264.74BC1000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileAssociation\" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\LowRegistry\\DontShowMeThisDialogAgain\" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\DontShowMeThisDialogAgain\" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp","\"Software\\Microsoft\\Windows\\Shell\" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp","\"Software\\Microsoft\\Windows\\Shell\\MuiCache\" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp","\"Software\\classes\" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp","\"Software\\Classes\\Applications\\%s\" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp","\"Software\\Classes\\Applications\" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp","\"Software\\Clients\\%s\" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp","\"Software\\Clients\\%s\\%s\" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp","\"Software\\Classes\\\" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp","\"SOFTWARE\\Microsoft\\Internet Explorer\" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp","\"Software\\Microsoft\\Windows NT\\Current Version\" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp","\"SOFTWARE\\Microsoft\\Internet Explorer\\Registration\" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU\" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp","\"Software\\Microsoft\\Internet Explorer\\TypedURLs\" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\TypedPaths\" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AutoComplete\" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\DeskView\" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp","\"Software\\Policies\" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp","\"Software\\Policies\\\" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp","\"Software\\Policies\\Microsoft\\Internet Explorer\" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp","\"Software\\Policies\\Microsoft\\Internet Explorer\\Main\" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp","\"Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp","\"Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp","\"Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp","\"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0\" in Source: 00000000-00007376.00000000.113264.74E31000.00000020.mdmp","\"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\" in Source: 00000000-00007376.00000000.113264.74E31000.00000020.mdmp","\"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\" in Source: 00000000-00007376.00000000.113264.74E31000.00000020.mdmp","\"\\Registry\\Machine\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Printers\" in Source: 00000000-00007376.00000000.113264.74E31000.00000020.mdmp","\"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\" in Source: 00000000-00007376.00000000.113264.74E31000.00000020.mdmp","\"\\REGISTRY\\MACHINE\\SYSTEM\\CurrentControlSet\\Control\\MiniNT\" in Source: 00000000-00007376.00000000.113264.74E31000.00000020.mdmp","\"Software\\Microsoft\\Windows NT\\CurrentVersion\\Type 1 Installer\\Type 1 Fonts\" in Source: 00000000-00007376.00000000.113264.74E31000.00000020.mdmp","\"System\\CurrentControlSet\\Control\\Power\\User\\Default\\PowerSchemes\" in Source: 00000000-00007376.00000000.113264.76371000.00000020.mdmp","\"System\\CurrentControlSet\\Control\\Power\\PowerSettings\" in Source: 00000000-00007376.00000000.113264.76371000.00000020.mdmp","\"System\\CurrentControlSet\\Control\\Power\\User\\PowerSchemes\" in Source: 00000000-00007376.00000000.113264.76371000.00000020.mdmp","\"System\\CurrentControlSet\\Policies\\Microsoft\\PortableOperatingSystem\" in Source: 00000000-00007376.00000000.113264.76371000.00000020.mdmp","\"System\\CurrentControlSet\\Services\\NDIS\\Parameters\" in Source: 00000000-00007376.00000000.113264.76371000.00000020.mdmp","\"System\\CurrentControlSet\\Control\\Power\\ModernSleep\" in Source: 00000000-00007376.00000000.113264.76371000.00000020.mdmp","\"Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\" in Source: 00000000-00007376.00000000.113264.76371000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\\" in Source: 00000000-00007376.00000000.113264.76501000.00000020.mdmp","\"System\\CurrentControlSet\\Control\\Hvsi\" in Source: 00000000-00007376.00000000.113264.76501000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FCM\\Impolite\" in Source: 00000000-00007376.00000000.113264.76501000.00000020.mdmp","\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Objects\\%s\" in Source: 00000000-00007376.00000000.113264.76501000.00000020.mdmp","\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Applications\\%s\" in Source: 00000000-00007376.00000000.113264.76501000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\QfePolicyDefinitions\\%s\\%s\" in Source: 00000000-00007376.00000000.113264.76501000.00000020.mdmp","\"Software\\Policies\\Microsoft\\Windows\" in Source: 00000000-00007376.00000000.113264.76501000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\" in Source: 00000000-00007376.00000000.113264.76501000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileInUseResolver\" in Source: 00000000-00007376.00000000.113264.76501000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\" in Source: 00000000-00007376.00000000.113264.76501000.00000020.mdmp","\"Unable to create RegKey HKLM\\%ws\" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp","\"software\\microsoft\\windows\\currentversion\\setup\\PnpLockdownFiles\" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\Setup\" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp","\"Software\\Microsoft\\EmbeddedNT\\Security\" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp","\"\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp","\"\\REGISTRY\\MACHINE\\SYSTEM\\CurrentControlSet\\Hardware Profiles\\Current\" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp","\"SYSTEM\\CurrentControlSet\\Control\\MediaResources\" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp","\"System\\CurrentControlSet\\Enum\" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp","\"System\\CurrentControlSet\\Control\\Wmi\\Security\" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp","\"System\\CurrentControlSet\\Control\\GroupOrderList\" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp","\"System\\CurrentControlSet\\Services\" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp","\"MACHINE\\software\\microsoft\\windows\\currentversion\\setup\\PnpLockdownFiles\" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp","\"software\\microsoft\\windows\\currentversion\\setup\\PnpResources\" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp","\"MACHINE\\software\\microsoft\\windows\\currentversion\\setup\\PnpResources\" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp","\"software\\Policies\\microsoft\\windows\\PnpLockdown\" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp","\"SYSTEM\\CurrentControlSet\\Control\\MiniNT\" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp","\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp","\"Software\\Policies\\Microsoft\\Windows\\DeviceInstall\" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\Device Installer\" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp","\"System\\CurrentControlSet\\Control\" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp","\"Software\\Microsoft\\Rpc\\SecurityService\" in Source: 00000000-00007376.00000000.113264.76D71000.00000020.mdmp","\"Software\\Microsoft\\Rpc\" in Source: 00000000-00007376.00000000.113264.76D71000.00000020.mdmp","\"System\\CurrentControlSet\\Services\\Rpc\\Linkage\" in Source: 00000000-00007376.00000000.113264.76D71000.00000020.mdmp","\"System\\CurrentControlSet\\Services\\Rpc\" in Source: 00000000-00007376.00000000.113264.76D71000.00000020.mdmp","\"Software\\Policies\\Microsoft\\Windows NT\\Rpc\" in Source: 00000000-00007376.00000000.113264.76D71000.00000020.mdmp","\"\\REGISTRY\\MACHINE\\Software\\Microsoft\\Rpc\\Extensions\" in Source: 00000000-00007376.00000000.113264.76D71000.00000020.mdmp","\"System\\CurrentControlSet\\Control\\SecurityProviders\" in Source: 00000000-00007376.00000000.113264.76D71000.00000020.mdmp","\"System\\CurrentControlSet\\Control\\Keyboard Layouts\" in Source: 00000000-00007376.00000000.113264.76E31000.00000020.mdmp","\"SOFTWARE\\Microsoft\\OLEAUT\" in Source: 00000000-00007376.00000000.113264.76E61000.00000020.mdmp","\"SOFTWARE\\Microsoft\\OLEAUT\\UserEra\" in Source: 00000000-00007376.00000000.113264.76E61000.00000020.mdmp","\"Software\\Microsoft\\OleAut\" in Source: 00000000-00007376.00000000.113264.76E61000.00000020.mdmp","\"Software\\classes\" in Source: 00000000-00007376.00000000.113264.76E61000.00000020.mdmp","\"Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp","\"\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppContainer\\Mappings\\\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp","\"Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppContainer\\Storage\\\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp","\"\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp","\"Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp","\"System\\CurrentControlSet\\Control\\Session Manager\\Environment\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp","\"s\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppContainer\\Mappings\\\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp","\"Software\\Microsoft\\Command Processor\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp","\"Software\\Microsoft\\CTF\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp","\"Software\\Microsoft\\Internet Explorer\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\AppHost\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\ClosedCaptioning\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\Shell Extensions\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\Themes\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\WinTrust\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp","\"Software\\Microsoft\\Windows\\Windows Error Reporting\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp","\"Software\\Microsoft\\Windows NT\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp","\"Software\\Microsoft\\Windows NT\\CurrentVersion\\ICM\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp","\"Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp","\"Software\\Microsoft\\Wisp\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp","\"Software\\Policies\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp","\"Software\\Microsoft\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp","\"Software\\Microsoft\\Windows\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\Holographic\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp","\"Software\\Microsoft\\SystemCertificates\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp","\"Software\\Microsoft\\Speech_OneCore\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp","\"Software\\Microsoft\\Speech\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp","\"Software\\Microsoft\\Speech Virtual\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp","\"\\Registry\\MACHINE\\System\\CurrentControlSet\\Control\\Session Manager\\AppCertDlls\" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp","\"\\Registry\\MACHINE\\System\\CurrentControlSet\\Control\\SafeBoot\\Option\" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp","\"\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp","\"\\Software\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp","\"SYSTEM\\CurrentControlSet\\Control\\WOW\" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp","\"\\Registry\\MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\SideBySide\" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp","\"\\Software\\Microsoft\\Windows NT\\CurrentVersion\" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp","\"Software\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Quirks\" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp","\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\NLS\\Language\" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp","\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\MUI\\CallbackDlls\" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp","\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\Sorting\\Ids\" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp","\"\\Registry\\Machine\\Software\\Microsoft\\Windows\\Containers\" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp","\"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\LanmanServer\\Parameters\" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp","\"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\DnsCache\\Parameters\" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp","\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\ComputerName\" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp","\"SYSTEM\\CurrentControlSet\\Control\\WinInit\" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp","\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Terminal Server\" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp","\"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\Compatibility\\Applications\\\" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp","\"\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppContainer\\Mappings\\\" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp","\"\\REGISTRY\\MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppCompat\" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp","\"\\REGISTRY\\MACHINE\\SYSTEM\\CurrentControlSet\\Control\\WOW\" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp","\"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AeDebug\" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp","\"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AeDebugProtected\" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp","\"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AeDebug\\AutoExclusionList\" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp","\"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AeDebugProtected\\AutoExclusionList\" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp","\"\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp","\"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\InstalledSDB\" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp","\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\ComputerName\\ComputerName\" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp","\"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters\" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp","\"Software\\Microsoft\\StorageLibrary\\ChangeTracking\\%s\\%d\" in Source: 00000000-00007376.00000000.113264.77756000.00000004.mdmp","\"Software\\Classes\" in Source: 00000000-00007376.00000000.113264.777D1000.00000020.mdmp","\"SOFTWARE\\Microsoft\\Ole\\Extensions\" in Source: 00000000-00007376.00000000.113264.777D1000.00000020.mdmp","\"\\Registry\\Machine\\Software\\Classes\\Interface\\%s\\TypeLib\" in Source: 00000000-00007376.00000000.113264.777D1000.00000020.mdmp","\"\\Registry\\Machine\\Software\\Classes\\Interface\\%s\\Forward\" in Source: 00000000-00007376.00000000.113264.777D1000.00000020.mdmp","\"\\Registry\\Machine\\Software\\Classes\\Interface\\{00020400-0000-0000-C000-000000000046}\" in Source: 00000000-00007376.00000000.113264.777D1000.00000020.mdmp","\"\\Registry\\Machine\\Software\\Classes\\Interface\" in Source: 00000000-00007376.00000000.113264.777D1000.00000020.mdmp","\"Registry\\Machine\\Software\\Classes\\\" in Source: 00000000-00007376.00000000.113264.777D1000.00000020.mdmp","\"Software\\Microsoft\\Ole\" in Source: 00000000-00007376.00000000.113264.777D1000.00000020.mdmp","\"\\Registry\\Machine\\Software\\Classes\\TypeLib\\%s\" in Source: 00000000-00007376.00000000.113264.777D1000.00000020.mdmp","\"Software\\Microsoft\\OLE\\Tracing\" in Source: 00000000-00007376.00000000.113264.777D1000.00000020.mdmp","\"Software\\Microsoft\\Ole\\AppCompat\" in Source: 00000000-00007376.00000000.113264.777D1000.00000020.mdmp","\"Software\\Microsoft\\OLE2\\UnknownUserType\" in Source: 00000000-00007376.00000000.113264.777D1000.00000020.mdmp","\"Software\\Microsoft\\OLE2\\DefaultIconLabel\" in Source: 00000000-00007376.00000000.113264.777D1000.00000020.mdmp","\"Software\\Microsoft\\OLE1\\UnregisteredVerb\" in Source: 00000000-00007376.00000000.113264.777D1000.00000020.mdmp","\"Software\\Microsoft\\OLE\" in Source: 00000000-00007376.00000000.113264.777D1000.00000020.mdmp","\"SYSTEM\\CurrentControlSet\\Control\\Session Manager\" in Source: 00000000-00007376.00000000.113264.777D1000.00000020.mdmp","\"Software\\Microsoft\\Internet Explorer\\International\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\URL\\Prefixes\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateChange\\PackageList\\\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"Software\\Policies\\Microsoft\\Control Panel\\International\\Calendars\\TwoDigitYearMax\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"\\Registry\\MACHINE\\System\\CurrentControlSet\\Control\\SafeBoot\\Option\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\ComputerName\\ActiveComputerName\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"\\Registry\\Machine\\Software\\Policies\\Microsoft\\System\\DNSclient\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\MUI\\StringCacheSettings\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"Software\\Classes\\Local Settings\\MuiCache\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"\\Registry\\Machine\\Software\\Classes\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Extensions\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"\\Registry\\Machine\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"\\Registry\\Machine\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Session Manager\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\SystemAppData\\\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Origins\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppContainer\\Mappings\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\FileSystem\\\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows\\System\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"\\Registry\\Machine\\Software\\Microsoft\\Wow64\\x86\\xtajit\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\URL\\DefaultPrefix\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"Software\\Classes\\Local Settings\\ImmutableMuiCache\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\CommonGlobUserSettings\\\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Families\\%s\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Families\\%s\\%s\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Families\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"HKEY_USERS\\...UserSid...\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"HKEY_USERS\\...UserSid...\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Families\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"HKEY_USERS\\...UserSid...\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Families\\...PackageFamilyName...\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"HKEY_USERS\\...UserSid...\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Families\\...family...\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Packages\\Applications\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Packages\\Applications\\ContentUriRules\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateChange\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"Open:Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateChange\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\AppX\\PackageVolumes\\%u\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\AppX\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Mappings\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateManager\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"Software\\Policies\\Microsoft\\Windows\\DataCollection\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AeDebug\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AeDebugProtected\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AeDebug\\AutoExclusionList\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AeDebugProtected\\AutoExclusionList\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\ComputerName\\ComputerName\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"\\REGISTRY\\MACHINE\\SOFTWARE\\CLASSES\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"\\REGISTRY\\MACHINE\\SYSTEM\\CURRENTCONTROLSET\\HARDWARE PROFILES\\CURRENT\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"Software\\Classes\\\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"\\Registry\\Machine\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Perflib\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp","\"\\Registry\\Machine\\Software\\Microsoft\\SecurityManager\\AdminCapabilities\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp","\"\\Registry\\Machine\\Software\\Policies\\Microsoft\\MUI\\Settings\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp","\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\NLS\\Language\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp","\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\MUI\\UILanguages\\PendingDelete\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp","\"Software\\Policies\\Microsoft\\Control Panel\\Desktop\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp","\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\MUI\\Settings\\LanguageConfiguration\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp","\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\MUI\\UILanguages\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp","\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\MUI\\Settings\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp","\"System\\CurrentControlSet\\Control\\CMF\\Config\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp","\"\\Software\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp","\"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\OEM\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp","\"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp","\"\\Registry\\Machine\\HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp","\"Registry\\Machine\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp","\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp","\"\\Registry\\MACHINE\\System\\CurrentControlSet\\Control\\SafeBoot\\Option\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp","\"\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp","\"\\Registry\\Machine\\Software\\Microsoft\\Windows\\CurrentVersion\\SideBySide\\AssemblyStorageRoots\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp","\"\\Registry\\MACHINE\\System\\CurrentControlSet\\Control\\Session Manager\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp","\"\\Registry\\MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Nls\\CustomLocale\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp","\"\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp","\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Srp\\GP\\DLL\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp","\")\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp","\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Session Manager\\kernel\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp","\"\\Registry\\Machine\\SOFTWARE\\Microsoft\\windows nt\\CurrentVersion\\Image File Execution Options\\\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp","\"\\Registry\\Machine\\System\\CurrentControlSet\\Services\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp","\"\\Registry\\Machine\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateChange\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp","\"\\Registry\\Machine\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateChange\\PackageList\\%ws\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp","\"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Compatibility Assistant\\\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp","\"\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp","\"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp","\"\\Registry\\Machine\\Software\\Microsoft\\SQMClient\\Windows\\WMR\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp","\"\\Registry\\Machine\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Escalation\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp","\"\\Software\\Microsoft\\Windows\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp","\"\\Registry\\MACHINE\\System\\CurrentControlSet\\Control\\Session Manager\\Safe Load Prefixes\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp","\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\CMF\\SQMData\\BootLanguages\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp","\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\ProductOptions\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp","\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\ValidationRunlevels\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp","\"\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Segment Heap\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp","\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\CommonGlobUserSettings\\\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp","\"System\\CurrentControlSet\\Control\\CMF\\LatestIndex\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp"],"description_v3":[{"type":"text","value":"\"SOFTWARE\\Microsoft\\Cryptography\\Defaults\\Provider\" in Source: 00000000-00007376.00000000.113264.72F31000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\Cryptography\\Defaults\\Provider\\\" in Source: 00000000-00007376.00000000.113264.72F31000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\Cryptography\\Defaults\\Provider Types\\Type \" in Source: 00000000-00007376.00000000.113264.72F31000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\Cryptography\\Defaults\\Provider Types\" in Source: 00000000-00007376.00000000.113264.72F31000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\Cryptography\\Providers\\Type \" in Source: 00000000-00007376.00000000.113264.72F31000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\SystemCertificates\\Root\\Certificates\\2BD63D28D7BCD0E251195AEB519243C13142EBC3\" in Source: 00000000-00007376.00000000.113264.72F31000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\SystemCertificates\\Root\\Certificates\\8A334AA8052DD244A647306A76B8178FA215F344\" in Source: 00000000-00007376.00000000.113264.72F31000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SYSTEM\\CurrentControlSet\\Control\\Print\" in Source: 00000000-00007376.00000000.113264.73051000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"System\\CurrentControlSet\\Control\\Print\" in Source: 00000000-00007376.00000000.113264.73051000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\" in Source: 00000000-00007376.00000000.113264.73051000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows NT\\CurrentVersion\\Devices\" in Source: 00000000-00007376.00000000.113264.73051000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"System\\CurrentControlSet\\Control\\Print\\Environments\" in Source: 00000000-00007376.00000000.113264.73051000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Perflib\" in Source: 00000000-00007376.00000000.113264.73051000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\CLASSES\\PACKAGEDCOM\\PACKAGE\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\Office\\16.0\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Wow6432Node\\Microsoft\\Office\\16.0\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\App Paths\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCU\\%s\\COMMON\\GENERAL\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\%s\\COMMON\\InstallRoot\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCU\\%s\\%s\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\%s\\%s\\InstallRoot\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCU\\SOFTWARE\\Classes\\%s.Application\\CurVer\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCU\\SOFTWARE\\Classes\\%s.Application.%s\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\%s.Application\\CurVer\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\%s.Application.%s\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\%s.Application\\CurVer\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\%s.Application.%s\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\%s\\%s\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\%s\\LocalServer\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\%s\\LocalServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\%s\\LocalServer\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\%s\\LocalServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\WOW6432Node\\CLSID\\%s\\LocalServer\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\WOW6432Node\\CLSID\\%s\\LocalServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\Software\\Classes\\\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\REGISTRY\\MACHINE\\SOFTWARE\\WOW6432Node\\\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\REGISTRY\\MACHINE\\SOFTWARE\\WOW6432Node\\Classes\\\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\System\\ControlSet001\\\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"System\\CurrentControlSet\\Control\\Session Manager\\Environment\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\Excel.Application\\CLSID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\Implemented Categories\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\Implemented Categories\\{000C0118-0000-0000-C000-000000000046}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\InprocHandler32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\InprocServer32\\15.0.0.0\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\LocalServer\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\LocalServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\ProgID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\VersionIndependentProgID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\Excel.Application\\CLSID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\Implemented Categories\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\Implemented Categories\\{000C0118-0000-0000-C000-000000000046}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\InprocHandler32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\InprocServer32\\15.0.0.0\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\LocalServer\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\LocalServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\ProgID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\VersionIndependentProgID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\Outlook.Application\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\Outlook.Application\\CLSID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCU\\SOFTWARE\\Classes\\Outlook.Application\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCU\\SOFTWARE\\Classes\\Outlook.Application\\CLSID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\Interface\\{00063001-0000-0000-C000-000000000046}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\Interface\\{00063001-0000-0000-C000-000000000046}\\ProxyStubClsid\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\Interface\\{00063001-0000-0000-C000-000000000046}\\ProxyStubClsid32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\Interface\\{00063001-0000-0000-C000-000000000046}\\TypeLib\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\Interface\\{00063001-0000-0000-C000-000000000046}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\Interface\\{00063001-0000-0000-C000-000000000046}\\ProxyStubClsid\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\Interface\\{00063001-0000-0000-C000-000000000046}\\ProxyStubClsid32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\Interface\\{00063001-0000-0000-C000-000000000046}\\TypeLib\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCU\\SOFTWARE\\Classes\\Interface\\{00063001-0000-0000-C000-000000000046}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCU\\SOFTWARE\\Classes\\Interface\\{00063001-0000-0000-C000-000000000046}\\ProxyStubClsid\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCU\\SOFTWARE\\Classes\\Interface\\{00063001-0000-0000-C000-000000000046}\\ProxyStubClsid32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCU\\SOFTWARE\\Classes\\Interface\\{00063001-0000-0000-C000-000000000046}\\TypeLib\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Microsoft\\Office\\16.0\\Outlook\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\WOW6432Node\\Microsoft\\Office\\16.0\\Outlook\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Clients\\Mail\\Microsoft Outlook\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\InprocServer32\\15.0.0.0\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\PowerPoint.Application\\CLSID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\InprocHandler\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\InprocHandler32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\InprocServer32\\15.0.0.0\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\LocalServer\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\LocalServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\ProgID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\VersionIndependentProgID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\InprocServer32\\15.0.0.0\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\PowerPoint.Application\\CLSID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\InprocHandler\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\InprocHandler32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\InprocServer32\\15.0.0.0\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\LocalServer\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\LocalServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\ProgID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\VersionIndependentProgID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\Word.Application\\CLSID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\WOW6432Node\\CLSID\\{000209FF-0000-0000-C000-000000000046}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\WOW6432Node\\CLSID\\{000209FF-0000-0000-C000-000000000046}\\InprocHandler32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\WOW6432Node\\CLSID\\{000209FF-0000-0000-C000-000000000046}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\WOW6432Node\\CLSID\\{000209FF-0000-0000-C000-000000000046}\\InprocServer32\\15.0.0.0\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\WOW6432Node\\CLSID\\{000209FF-0000-0000-C000-000000000046}\\LocalServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\WOW6432Node\\CLSID\\{000209FF-0000-0000-C000-000000000046}\\ProgID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\WOW6432Node\\CLSID\\{000209FF-0000-0000-C000-000000000046}\\VersionIndependentProgID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\Word.Application\\CLSID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{000209FF-0000-0000-C000-000000000046}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{000209FF-0000-0000-C000-000000000046}\\InprocHandler32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{000209FF-0000-0000-C000-000000000046}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{000209FF-0000-0000-C000-000000000046}\\InprocServer32\\15.0.0.0\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{000209FF-0000-0000-C000-000000000046}\\LocalServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{000209FF-0000-0000-C000-000000000046}\\ProgID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{000209FF-0000-0000-C000-000000000046}\\VersionIndependentProgID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"System\\CurrentControlSet\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Classes\\CLSID\\%ls\\LocalServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Classes\\CLSID\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCU\\Software\\Classes\\\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Classes\\\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCC\\System\\CurrentControlSet\\Control\\Print\\Printers\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Microsoft\\Direct3D\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Classes\\Body5\\Open\\Shell\\Command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Encore Software\\Middle School Advantage 2001\\1.0\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\nowcom\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCU\\Software\\nowcom\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\nowirc\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCU\\Software\\nowirc\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\nownuri\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCU\\Software\\nownuri\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows NT\\CurrentVersion\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Microsoft\\MSN\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\MSN\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Config\\0001\\Display\\Settings\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"System\\CurrentControlSet\\Enum\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\System\\CurrentControlSet\\Enum\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCU\\Software\\Microsoft\\CTF\\LangBar\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\ODBC\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\System\\CurrentControlSet\\services\\W3svc\\Parameters\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Microsoft\\Outlook Express\\Inetcomm\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Microsoft\\Outlook Express\\Version Info\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Memory Management\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Memory Management\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{083863F1-70DE-11D0-BD40-00A0C911CE86}\\Instance\\{4CB63E61-C611-11D0-83AA-000092900184}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{4CB63E61-C611-11D0-83AA-000092900184}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{4CB63E61-C611-11D0-83AA-000092900184}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{4CB63E62-C611-11D0-83AA-000092900184}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{4CB63E62-C611-11D0-83AA-000092900184}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{083863F1-70DE-11D0-BD40-00A0C911CE86}\\Instance\\{B4CA2970-DD2B-11D0-9DFA-00AA00AF3494}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{B4CA2970-DD2B-11D0-9DFA-00AA00AF3494}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{B4CA2970-DD2B-11D0-9DFA-00AA00AF3494}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{B4CA2971-DD2B-11D0-9DFA-00AA00AF3494}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{B4CA2971-DD2B-11D0-9DFA-00AA00AF3494}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{C83B5610-E0DF-11D0-9E00-00AA00AF3494}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{C83B5610-E0DF-11D0-9E00-00AA00AF3494}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\drivers.desc\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Drivers32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\System\\CurrentControlSet\\Control\\MediaProperties\\PrivateProperties\\Joystick\\Winmm\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{31345649-0000-0010-8000-00AA00389B71}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{31345649-0000-0010-8000-00AA00389B71}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{31345649-0000-0010-8000-00AA00389B71}\\Pins\\Input\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{31345649-0000-0010-8000-00AA00389B71}\\Pins\\Input\\Types\\{73646976-0000-0010-8000-00AA00389B71}\\{31345649-0000-0010-8000-00AA00389B71}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{31345649-0000-0010-8000-00AA00389B71}\\Pins\\Output\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{31345649-0000-0010-8000-00AA00389B71}\\Pins\\Output\\Types\\{73646976-0000-0010-8000-00AA00389B71}\\{00000000-0000-0000-0000-000000000000}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{87CA6F02-49E4-11CF-A3FE-00AA003735BE}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{87CA6F02-49E4-11CF-A3FE-00AA003735BE}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{87CA6F04-49E4-11CF-A3FE-00AA003735BE}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{87CA6F04-49E4-11CF-A3FE-00AA003735BE}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{A2551F60-705F-11CF-A424-00AA003735BE}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{A2551F60-705F-11CF-A424-00AA003735BE}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{A2551F60-705F-11CF-A424-00AA003735BE}\\Pins\\Input\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{A2551F60-705F-11CF-A424-00AA003735BE}\\Pins\\Input\\Types\\{73646976-0000-0010-8000-00AA00389B71}\\{00000000-0000-0000-0000-000000000000}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{A2551F60-705F-11CF-A424-00AA003735BE}\\Pins\\Output\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{A2551F60-705F-11CF-A424-00AA003735BE}\\Pins\\Output\\Types\\{73646976-0000-0010-8000-00AA00389B71}\\{31345649-0000-0010-8000-00AA00389B71}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{BD323430-CE94-11CE-82DD-0800095A5B55}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{BD323430-CE94-11CE-82DD-0800095A5B55}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{BD323431-CE94-11CE-82DD-0800095A5B55}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{BD323431-CE94-11CE-82DD-0800095A5B55}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{BD323432-CE94-11CE-82DD-0800095A5B55}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{BD323432-CE94-11CE-82DD-0800095A5B55}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{BD323433-CE94-11CE-82DD-0800095A5B55}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{BD323433-CE94-11CE-82DD-0800095A5B55}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\Filter\\{31345649-0000-0010-8000-00AA00389B71}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\Filter\\{A2551F60-705F-11CF-A424-00AA003735BE}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCU\\Software\\Intel\\Indeo\\4.1\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{083863F1-70DE-11D0-BD40-00A0C911CE86}\\Instance\\{1F73E9B1-8C3A-11D0-A3BE-00A0C9244436}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{083863F1-70DE-11D0-BD40-00A0C911CE86}\\Instance\\{30355649-0000-0010-8000-00AA00389B71}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{1F73E9B1-8C3A-11D0-A3BE-00A0C9244436}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{1F73E9B1-8C3A-11D0-A3BE-00A0C9244436}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{2DE89781-DBF6-11D0-A30E-444553540000}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{2DE89781-DBF6-11D0-A30E-444553540000}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{30355649-0000-0010-8000-00AA00389B71}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{30355649-0000-0010-8000-00AA00389B71}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{33D9A760-90C8-11D0-BD43-00A0C911CE86}\\Instance\\Indeo\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{665A4443-D905-11D0-A30E-444553540000}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{665A4443-D905-11D0-A30E-444553540000}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{665A4444-D905-11D0-A30E-444553540000}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{665A4444-D905-11D0-A30E-444553540000}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{665A4445-D905-11D0-A30E-444553540000}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{665A4445-D905-11D0-A30E-444553540000}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{665A4448-D905-11D0-A30E-444553540000}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{665A4448-D905-11D0-A30E-444553540000}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{665A444A-D905-11D0-A30E-444553540000}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{665A444A-D905-11D0-A30E-444553540000}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{84725EA1-2FBC-11D1-BC86-00A0C969FC67}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{84725EA1-2FBC-11D1-BC86-00A0C969FC67}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{C1C0FE00-F3C2-11D0-91D4-444553540000}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{C1C0FE00-F3C2-11D0-91D4-444553540000}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{E369A160-F3C2-11D0-91D4-444553540000}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{E369A160-F3C2-11D0-91D4-444553540000}\\InprocServer32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\Interface\\{665A4447-D905-11D0-A30E-444553540000}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\Interface\\{665A4447-D905-11D0-A30E-444553540000}\\ProxyStubClsid\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\Interface\\{665A4447-D905-11D0-A30E-444553540000}\\ProxyStubClsid32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\Interface\\{665A4447-D905-11D0-A30E-444553540000}\\TypeLib\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\Interface\\{665A4449-D905-11D0-A30E-444553540000}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\Interface\\{665A4449-D905-11D0-A30E-444553540000}\\ProxyStubClsid\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\Interface\\{665A4449-D905-11D0-A30E-444553540000}\\ProxyStubClsid32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\Interface\\{665A4449-D905-11D0-A30E-444553540000}\\TypeLib\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\TypeLib\\{665A4446-D905-11D0-A30E-444553540000}\\1.0\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\TypeLib\\{665A4446-D905-11D0-A30E-444553540000}\\1.0\\0\\win32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\TypeLib\\{665A4446-D905-11D0-A30E-444553540000}\\1.0\\FLAGS\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\TypeLib\\{665A4446-D905-11D0-A30E-444553540000}\\1.0\\HELPDIR\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCU\\Software\\Classes\\iTunes.BurnCD\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\iTunes.BurnCD\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCU\\Software\\Classes\\MIME\\Database\\Content Type\\application/x-itunes-itms\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\MIME\\Database\\Content Type\\application/x-itunes-itms\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCU\\Software\\Classes\\MIME\\Database\\Content Type\\application/x-itunes-itpc\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\MIME\\Database\\Content Type\\application/x-itunes-itpc\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCU\\Software\\Classes\\MIME\\Database\\Content Type\\application/x-podcast\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\MIME\\Database\\Content Type\\application/x-podcast\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SYSTEM\\ControlSet001\\Control\\ProductOptions\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SYSTEM\\ControlSet002\\Control\\ProductOptions\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SYSTEM\\ControlSet003\\Control\\ProductOptions\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SYSTEM\\CurrentControlSet\\Control\\ProductOptions\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\chm.file\\shell\\open\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\software\\microsoft\\IE Setup\\SETUP\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\software\\microsoft\\Windows NT\\CurrentVersion\\Hotfix\\ \" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SYSTEM\\WPA\\MediaCenter\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\software\\microsoft\\Outlook Express\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Microsoft\\Direct3D\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Microsoft\\DirectDraw\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\ThemeManager\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Microsoft\\WAB\\DLLPath\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCU\\Software\\Microsoft\\Direct3D\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Microsoft\\Internet Explorer\\Version Vector\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Microsoft\\NET Framework Setup\\NDP\\v4\\Client\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Microsoft\\NET Framework Setup\\NDP\\v4\\Full\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Macromedia\\FlashPlayerActiveY_BOGUSKEY\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Macromedia\\FlashPlayerActiveX\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\CLSID\\{031E4825-7B94-4dc3-B131-E946B44C8DD5}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Wow6432Node\\Microsoft\\NET Framework Setup\\NDP\\v4\\Client\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Wow6432Node\\Microsoft\\NET Framework Setup\\NDP\\v4\\Full\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Wow6432Node\\Microsoft\\Internet Explorer\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Controls Folder\\Desk\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Controls Folder\\Display\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\System\\CurrentControlSet\\Control\\Class\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\System\\CurrentControlSet\\Services\\Class\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\System\\CurrentControlSet\\Control\\Class\\{4D36E968-E325-11CE-BFC1-08002BE10318}\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\System\\CurrentControlSet\\Services\\Class\\Display\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Cache\\Special Paths\\Cookies\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Hasbro Interactive\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SYSTEM\\CurrentControlSet\\Enum\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Enum\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SYSTEM\\CurrentControlSet\\Enum\\PCI\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCC\\Software\\Fonts\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"System\\CurrentControlSet\\Control\\Nls\\Locale\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\WORDPAD.EXE\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\rtffile\\shell\\open\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\rtffile\\shell\\print\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\rtffile\\shell\\printto\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\Wordpad.Document.1\\shell\\open\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\Wordpad.Document.1\\shell\\print\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\Wordpad.Document.1\\shell\\printto\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\wrifile\\shell\\open\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\wrifile\\shell\\print\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCR\\wrifile\\shell\\printto\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Classes\\Applications\\wordpad.exe\\shell\\open\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Classes\\Applications\\wordpad.exe\\shell\\print\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Classes\\Applications\\wordpad.exe\\shell\\printto\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Classes\\rtffile\\shell\\open\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Classes\\rtffile\\shell\\print\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Classes\\rtffile\\shell\\printto\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Classes\\Wordpad.Document.1\\shell\\open\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Classes\\Wordpad.Document.1\\shell\\print\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Classes\\Wordpad.Document.1\\shell\\printto\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Classes\\wrifile\\shell\\open\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Classes\\wrifile\\shell\\print\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Classes\\wrifile\\shell\\printto\\command\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Setup\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"System\\CurrentControlSet\\Services\\NetBT\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows NT\\CurrentVersion\\NetworkCards\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\System\\CurrentControlSet\\Control\\Windows\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Applications\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Microsoft\\DirectX\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\DXDIAG.EXE\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Electronic Arts\\Future Cop\\Settings\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows NT\\CurrentVersion\\Drivers32\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\System\\CurrentControlSet\\Control\\MediaResources\\ACM\\MSACM.MSADPCM\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Microsoft\\Windows\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCU\\Software\\Microsoft\\Windows\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\FirstByte\\ProVoice\\SpeechFonts\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Microsoft\\Internet Explorer\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"System\\CurrentControlSet\\Control\\MediaProperties\\PrivateProperties\\Joystick\\OEM\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCU\\Software\\Adobe\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Adobe\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\Software\\Adobe\\PageMaker65\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCU\\Software\\Adobe\\PageMaker65\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKCU\\Software\\Caere Corp\\PageKeepPro30\\Preference\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Caere Corp\\Scan Manager\\4.02\\Scanners\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SYSTEM\\CurrentControlSet\\Enum\\Root\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\Components\\359E92CC2CB71D119A12000A9CE1A22A\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\System\\CurrentControlSet\\Services\\W3SVC\\Parameters\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\System\\CurrentControlSet\\Control\\MediaResources\\DirectSound\\Application Compatibility\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Windows File Protection\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\HKEY_CURRENT_USER\\Software\\Classes\\\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Volatile\\00\" in Source: 00000000-00007376.00000000.113264.730C1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy\" in Source: 00000000-00007376.00000000.113264.73451000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa\" in Source: 00000000-00007376.00000000.113264.73451000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Accent\" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Policies\\Microsoft\\Windows\\Personalization\" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\DWM\" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\ImmersiveShell\" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\ThemeManager\" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\DiagnosticAnimationXML\" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\".Default\\Software\\Microsoft\\Windows\\CurrentVersion\\ThemeManager\" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Themes\\History\\Colors\" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Themes\\History\" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Accents\" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Wisp\\Touch\" in Source: 00000000-00007376.00000000.113264.74041000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Software\\Classes\\CLSID\\\" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\Software\\Microsoft\\Windows\\CurrentVersion\" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Layers\" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\InstalledSDB\" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Custom\" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Disable8And16BitMitigation\" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" in Source: 00000000-00007376.00000000.113264.74491000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\Software\\Microsoft\\Wow64\\\" in Source: 00000000-00007376.00000000.113264.74624000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\REGISTRY\\MACHINE\\SOFTWARE\\Wow6432Node\" in Source: 00000000-00007376.00000000.113264.74624000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\REGISTRY\\USER\\*\\SOFTWARE\\Classes\" in Source: 00000000-00007376.00000000.113264.74624000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\REGISTRY\\USER\\*\\SOFTWARE\\Classes\\Wow6432Node\" in Source: 00000000-00007376.00000000.113264.74624000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"system\\CurrentControlSet\\Control\\NetworkProvider\" in Source: 00000000-00007376.00000000.113264.746E1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"system\\CurrentControlSet\\control\\NetworkProvider\\ProviderOrder\" in Source: 00000000-00007376.00000000.113264.746E1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"system\\CurrentControlSet\\control\\NetworkProvider\\HwOrder\" in Source: 00000000-00007376.00000000.113264.746E1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"system\\CurrentControlSet\" in Source: 00000000-00007376.00000000.113264.746E1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"system\\CurrentControlSet\\Control\\NetworkProvider\\Notifyees\" in Source: 00000000-00007376.00000000.113264.746E1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" in Source: 00000000-00007376.00000000.113264.746E1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Network\" in Source: 00000000-00007376.00000000.113264.746E1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters\\Interfaces\\\" in Source: 00000000-00007376.00000000.113264.74701000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SYSTEM\\CurrentControlSet\\Services\\Tcpip6\\Parameters\\Interfaces\\\" in Source: 00000000-00007376.00000000.113264.74701000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SYSTEM\\CurrentControlSet\\Services\\NetBT\\Parameters\" in Source: 00000000-00007376.00000000.113264.74701000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"System\\CurrentControlSet\\Services\\NcbService\\NCB\" in Source: 00000000-00007376.00000000.113264.74701000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\wcmsvc\\wifinetworkmanager\\config\" in Source: 00000000-00007376.00000000.113264.74701000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SYSTEM\\CurrentControlSet\\Control\\Lsa\\MSV1_0\" in Source: 00000000-00007376.00000000.113264.74741000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"System\\CurrentControlSet\\Control\\SecurityProviders\" in Source: 00000000-00007376.00000000.113264.74741000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"System\\CurrentControlSet\\Control\\Lsa\\SspiCache\" in Source: 00000000-00007376.00000000.113264.74741000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"System\\CurrentControlSet\\Control\\SecurityProviders\\SaslProfiles\" in Source: 00000000-00007376.00000000.113264.74741000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"System\\CurrentControlSet\\Control\\Lsa\" in Source: 00000000-00007376.00000000.113264.74741000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"System\\CurrentControlSet\\Control\\Hvsi\" in Source: 00000000-00007376.00000000.113264.74741000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SYSTEM\\CurrentControlSet\\Services\\Netlogon\\Parameters\\GpParameters\" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SYSTEM\\CurrentControlSet\\Services\\Netlogon\\Parameters\" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Perflib\" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\REGISTRY\\MACHINE\\SYSTEM\\CurrentControlSet\\Services\" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Perflib\" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows\\Safer\" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Software\\Policies\\Microsoft\\Windows\\Safer\" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"System\\CurrentControlSet\\Control\\IDConfigDB\" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\Software\\Classes\" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"System\\CurrentControlSet\\Control\\LSA\\AccessProviders\" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Srp\\GP\\\" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\MACHINE\\System\\CurrentControlSet\\Control\\SafeBoot\\Option\" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Group Policy\\Appmgmt\" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows NT\\CurrentVersion\\Diagnostics\" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\SrpExtensionConfig\" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"%HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRoot%\" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"%HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ProgramFilesDir%\" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"System\\CurrentControlSet\\Services\\\" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\REGISTRY\\MACHINE\\SOFTWARE\\CLASSES\" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Classes\\\" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SYSTEM\\CurrentControlSet\\Control\\Lsa\" in Source: 00000000-00007376.00000000.113264.74781000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SYSTEM\\CurrentControlSet\\Control\\DevQuery\" in Source: 00000000-00007376.00000000.113264.74801000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SYSTEM\\CurrentControlSet\\Services\\DeviceInstall\\Parameters\" in Source: 00000000-00007376.00000000.113264.74801000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SYSTEM\\CurrentControlSet\\Services\\DeviceInstall\" in Source: 00000000-00007376.00000000.113264.74801000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"System\\CurrentControlSet\\Control\\IDConfigDB\" in Source: 00000000-00007376.00000000.113264.74801000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Setup\" in Source: 00000000-00007376.00000000.113264.74801000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\" in Source: 00000000-00007376.00000000.113264.74801000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\REGISTRY\\MACHINE\\SYSTEM\\CurrentControlSet\\Hardware Profiles\\Current\" in Source: 00000000-00007376.00000000.113264.74801000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SYSTEM\\CurrentControlSet\\Control\\Cryptography\\ECCParameters\" in Source: 00000000-00007376.00000000.113264.74841000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Policies\\Microsoft\\Cryptography\\Configuration\" in Source: 00000000-00007376.00000000.113264.74841000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa\" in Source: 00000000-00007376.00000000.113264.74841000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy\" in Source: 00000000-00007376.00000000.113264.74841000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\" in Source: 00000000-00007376.00000000.113264.749F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\" in Source: 00000000-00007376.00000000.113264.749F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Keyboard Layout\" in Source: 00000000-00007376.00000000.113264.749F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Keyboard Layout\\\" in Source: 00000000-00007376.00000000.113264.749F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Keyboard Layouts\\\" in Source: 00000000-00007376.00000000.113264.749F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows\\Display\" in Source: 00000000-00007376.00000000.113264.749F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\Software\\Microsoft\\Windows\\Tablet PC\\\" in Source: 00000000-00007376.00000000.113264.749F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\Software\\Microsoft\\Windows\\CurrentVersion\\Media Center\\\" in Source: 00000000-00007376.00000000.113264.749F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Policies\\Microsoft\\Windows NT\\Reliability\" in Source: 00000000-00007376.00000000.113264.749F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\Software\\Microsoft\\Windows\\CurrentVersion\\ImmersiveShell\\\" in Source: 00000000-00007376.00000000.113264.749F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"System\\CurrentControlSet\\Services\" in Source: 00000000-00007376.00000000.113264.74B71000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SYSTEM\\CurrentControlSet\\Services\\Netlogon\\Parameters\\GpParameters\" in Source: 00000000-00007376.00000000.113264.74B71000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SYSTEM\\CurrentControlSet\\Services\\Netlogon\\Parameters\" in Source: 00000000-00007376.00000000.113264.74B71000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\IdentityStore\\Providers\" in Source: 00000000-00007376.00000000.113264.74B71000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\REGISTRY\\MACHINE\\Software\\Microsoft\\SecurityManager\\TransientObjects\\\" in Source: 00000000-00007376.00000000.113264.74B71000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"System\\CurrentControlSet\\Control\\SQMServiceList\" in Source: 00000000-00007376.00000000.113264.74B71000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\MiniNT\" in Source: 00000000-00007376.00000000.113264.74B71000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"System\\CurrentControlSet\\Control\" in Source: 00000000-00007376.00000000.113264.74B71000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SYSTEM\\CurrentControlSet\\Control\\WMI\\Security\" in Source: 00000000-00007376.00000000.113264.74B71000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SYSTEM\\CurrentControlSet\\Control\\Lsa\" in Source: 00000000-00007376.00000000.113264.74B71000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"System\\CurrentControlSet\\Services\\WinSock2\\Parameters\" in Source: 00000000-00007376.00000000.113264.74BC1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"System\\CurrentControlSet\\Services\\Winsock2\\Parameters\" in Source: 00000000-00007376.00000000.113264.74BC1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"System\\CurrentControlSet\\Services\\Tcpip\\Parameters\" in Source: 00000000-00007376.00000000.113264.74BC1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\WinSock2\\Parameters\" in Source: 00000000-00007376.00000000.113264.74BC1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\WS2IFSL\" in Source: 00000000-00007376.00000000.113264.74BC1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileAssociation\" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\LowRegistry\\DontShowMeThisDialogAgain\" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\DontShowMeThisDialogAgain\" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\Shell\" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\Shell\\MuiCache\" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\classes\" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Classes\\Applications\\%s\" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Classes\\Applications\" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Clients\\%s\" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Clients\\%s\\%s\" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Classes\\\" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\Internet Explorer\" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows NT\\Current Version\" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\Internet Explorer\\Registration\" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU\" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Internet Explorer\\TypedURLs\" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\TypedPaths\" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AutoComplete\" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\DeskView\" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Policies\" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Policies\\\" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Policies\\Microsoft\\Internet Explorer\" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Policies\\Microsoft\\Internet Explorer\\Main\" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\" in Source: 00000000-00007376.00000000.113264.74D81000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0\" in Source: 00000000-00007376.00000000.113264.74E31000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\" in Source: 00000000-00007376.00000000.113264.74E31000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\" in Source: 00000000-00007376.00000000.113264.74E31000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Printers\" in Source: 00000000-00007376.00000000.113264.74E31000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\" in Source: 00000000-00007376.00000000.113264.74E31000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\REGISTRY\\MACHINE\\SYSTEM\\CurrentControlSet\\Control\\MiniNT\" in Source: 00000000-00007376.00000000.113264.74E31000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows NT\\CurrentVersion\\Type 1 Installer\\Type 1 Fonts\" in Source: 00000000-00007376.00000000.113264.74E31000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"System\\CurrentControlSet\\Control\\Power\\User\\Default\\PowerSchemes\" in Source: 00000000-00007376.00000000.113264.76371000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"System\\CurrentControlSet\\Control\\Power\\PowerSettings\" in Source: 00000000-00007376.00000000.113264.76371000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"System\\CurrentControlSet\\Control\\Power\\User\\PowerSchemes\" in Source: 00000000-00007376.00000000.113264.76371000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"System\\CurrentControlSet\\Policies\\Microsoft\\PortableOperatingSystem\" in Source: 00000000-00007376.00000000.113264.76371000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"System\\CurrentControlSet\\Services\\NDIS\\Parameters\" in Source: 00000000-00007376.00000000.113264.76371000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"System\\CurrentControlSet\\Control\\Power\\ModernSleep\" in Source: 00000000-00007376.00000000.113264.76371000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\" in Source: 00000000-00007376.00000000.113264.76371000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\\" in Source: 00000000-00007376.00000000.113264.76501000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"System\\CurrentControlSet\\Control\\Hvsi\" in Source: 00000000-00007376.00000000.113264.76501000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FCM\\Impolite\" in Source: 00000000-00007376.00000000.113264.76501000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Objects\\%s\" in Source: 00000000-00007376.00000000.113264.76501000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Applications\\%s\" in Source: 00000000-00007376.00000000.113264.76501000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\QfePolicyDefinitions\\%s\\%s\" in Source: 00000000-00007376.00000000.113264.76501000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Policies\\Microsoft\\Windows\" in Source: 00000000-00007376.00000000.113264.76501000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\" in Source: 00000000-00007376.00000000.113264.76501000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileInUseResolver\" in Source: 00000000-00007376.00000000.113264.76501000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\" in Source: 00000000-00007376.00000000.113264.76501000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Unable to create RegKey HKLM\\%ws\" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"software\\microsoft\\windows\\currentversion\\setup\\PnpLockdownFiles\" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Setup\" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\EmbeddedNT\\Security\" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\REGISTRY\\MACHINE\\SYSTEM\\CurrentControlSet\\Hardware Profiles\\Current\" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SYSTEM\\CurrentControlSet\\Control\\MediaResources\" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"System\\CurrentControlSet\\Enum\" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"System\\CurrentControlSet\\Control\\Wmi\\Security\" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"System\\CurrentControlSet\\Control\\GroupOrderList\" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"System\\CurrentControlSet\\Services\" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"MACHINE\\software\\microsoft\\windows\\currentversion\\setup\\PnpLockdownFiles\" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"software\\microsoft\\windows\\currentversion\\setup\\PnpResources\" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"MACHINE\\software\\microsoft\\windows\\currentversion\\setup\\PnpResources\" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"software\\Policies\\microsoft\\windows\\PnpLockdown\" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SYSTEM\\CurrentControlSet\\Control\\MiniNT\" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Policies\\Microsoft\\Windows\\DeviceInstall\" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Device Installer\" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"System\\CurrentControlSet\\Control\" in Source: 00000000-00007376.00000000.113264.76941000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Rpc\\SecurityService\" in Source: 00000000-00007376.00000000.113264.76D71000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Rpc\" in Source: 00000000-00007376.00000000.113264.76D71000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"System\\CurrentControlSet\\Services\\Rpc\\Linkage\" in Source: 00000000-00007376.00000000.113264.76D71000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"System\\CurrentControlSet\\Services\\Rpc\" in Source: 00000000-00007376.00000000.113264.76D71000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Policies\\Microsoft\\Windows NT\\Rpc\" in Source: 00000000-00007376.00000000.113264.76D71000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\REGISTRY\\MACHINE\\Software\\Microsoft\\Rpc\\Extensions\" in Source: 00000000-00007376.00000000.113264.76D71000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"System\\CurrentControlSet\\Control\\SecurityProviders\" in Source: 00000000-00007376.00000000.113264.76D71000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"System\\CurrentControlSet\\Control\\Keyboard Layouts\" in Source: 00000000-00007376.00000000.113264.76E31000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\OLEAUT\" in Source: 00000000-00007376.00000000.113264.76E61000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\OLEAUT\\UserEra\" in Source: 00000000-00007376.00000000.113264.76E61000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\OleAut\" in Source: 00000000-00007376.00000000.113264.76E61000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\classes\" in Source: 00000000-00007376.00000000.113264.76E61000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppContainer\\Mappings\\\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppContainer\\Storage\\\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"System\\CurrentControlSet\\Control\\Session Manager\\Environment\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"s\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppContainer\\Mappings\\\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Command Processor\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\CTF\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Internet Explorer\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\AppHost\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\ClosedCaptioning\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Shell Extensions\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Themes\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\WinTrust\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\Windows Error Reporting\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows NT\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows NT\\CurrentVersion\\ICM\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Wisp\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Policies\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Holographic\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\SystemCertificates\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Speech_OneCore\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Speech\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Speech Virtual\" in Source: 00000000-00007376.00000000.113264.77071000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\MACHINE\\System\\CurrentControlSet\\Control\\Session Manager\\AppCertDlls\" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\MACHINE\\System\\CurrentControlSet\\Control\\SafeBoot\\Option\" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Software\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SYSTEM\\CurrentControlSet\\Control\\WOW\" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\SideBySide\" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Software\\Microsoft\\Windows NT\\CurrentVersion\" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Quirks\" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\NLS\\Language\" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\MUI\\CallbackDlls\" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\Sorting\\Ids\" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\Software\\Microsoft\\Windows\\Containers\" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\LanmanServer\\Parameters\" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\DnsCache\\Parameters\" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\ComputerName\" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SYSTEM\\CurrentControlSet\\Control\\WinInit\" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Terminal Server\" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\Compatibility\\Applications\\\" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppContainer\\Mappings\\\" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\REGISTRY\\MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppCompat\" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\REGISTRY\\MACHINE\\SYSTEM\\CurrentControlSet\\Control\\WOW\" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AeDebug\" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AeDebugProtected\" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AeDebug\\AutoExclusionList\" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AeDebugProtected\\AutoExclusionList\" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\InstalledSDB\" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\ComputerName\\ComputerName\" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters\" in Source: 00000000-00007376.00000000.113264.77110000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\StorageLibrary\\ChangeTracking\\%s\\%d\" in Source: 00000000-00007376.00000000.113264.77756000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Classes\" in Source: 00000000-00007376.00000000.113264.777D1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\Ole\\Extensions\" in Source: 00000000-00007376.00000000.113264.777D1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\Software\\Classes\\Interface\\%s\\TypeLib\" in Source: 00000000-00007376.00000000.113264.777D1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\Software\\Classes\\Interface\\%s\\Forward\" in Source: 00000000-00007376.00000000.113264.777D1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\Software\\Classes\\Interface\\{00020400-0000-0000-C000-000000000046}\" in Source: 00000000-00007376.00000000.113264.777D1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\Software\\Classes\\Interface\" in Source: 00000000-00007376.00000000.113264.777D1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Registry\\Machine\\Software\\Classes\\\" in Source: 00000000-00007376.00000000.113264.777D1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Ole\" in Source: 00000000-00007376.00000000.113264.777D1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\Software\\Classes\\TypeLib\\%s\" in Source: 00000000-00007376.00000000.113264.777D1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\OLE\\Tracing\" in Source: 00000000-00007376.00000000.113264.777D1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Ole\\AppCompat\" in Source: 00000000-00007376.00000000.113264.777D1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\OLE2\\UnknownUserType\" in Source: 00000000-00007376.00000000.113264.777D1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\OLE2\\DefaultIconLabel\" in Source: 00000000-00007376.00000000.113264.777D1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\OLE1\\UnregisteredVerb\" in Source: 00000000-00007376.00000000.113264.777D1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\OLE\" in Source: 00000000-00007376.00000000.113264.777D1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SYSTEM\\CurrentControlSet\\Control\\Session Manager\" in Source: 00000000-00007376.00000000.113264.777D1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Internet Explorer\\International\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\URL\\Prefixes\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages\\\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateChange\\PackageList\\\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Policies\\Microsoft\\Control Panel\\International\\Calendars\\TwoDigitYearMax\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\MACHINE\\System\\CurrentControlSet\\Control\\SafeBoot\\Option\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\ComputerName\\ActiveComputerName\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\Software\\Policies\\Microsoft\\System\\DNSclient\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\MUI\\StringCacheSettings\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Classes\\Local Settings\\MuiCache\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\Software\\Classes\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Extensions\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Session Manager\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\SystemAppData\\\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Origins\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppContainer\\Mappings\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\FileSystem\\\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows\\System\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\Software\\Microsoft\\Wow64\\x86\\xtajit\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\URL\\DefaultPrefix\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Classes\\Local Settings\\ImmutableMuiCache\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\CommonGlobUserSettings\\\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Families\\%s\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Families\\%s\\%s\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Families\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKEY_USERS\\...UserSid...\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKEY_USERS\\...UserSid...\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Families\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKEY_USERS\\...UserSid...\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Families\\...PackageFamilyName...\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKEY_USERS\\...UserSid...\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Families\\...family...\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Packages\\Applications\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Packages\\Applications\\ContentUriRules\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Packages\\\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateChange\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Open:Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateChange\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\AppX\\PackageVolumes\\%u\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\AppX\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Mappings\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateManager\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Policies\\Microsoft\\Windows\\DataCollection\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection\\Users\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AeDebug\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AeDebugProtected\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AeDebug\\AutoExclusionList\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AeDebugProtected\\AutoExclusionList\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\ComputerName\\ComputerName\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\REGISTRY\\MACHINE\\SOFTWARE\\CLASSES\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\REGISTRY\\MACHINE\\SYSTEM\\CURRENTCONTROLSET\\HARDWARE PROFILES\\CURRENT\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Classes\\\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Perflib\" in Source: 00000000-00007376.00000000.113264.778F1000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\Software\\Microsoft\\SecurityManager\\AdminCapabilities\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\Software\\Policies\\Microsoft\\MUI\\Settings\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\NLS\\Language\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\MUI\\UILanguages\\PendingDelete\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Policies\\Microsoft\\Control Panel\\Desktop\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\MUI\\Settings\\LanguageConfiguration\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\MUI\\UILanguages\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\MUI\\Settings\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"System\\CurrentControlSet\\Control\\CMF\\Config\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Software\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\OEM\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Registry\\Machine\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\MACHINE\\System\\CurrentControlSet\\Control\\SafeBoot\\Option\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\Software\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\Software\\Microsoft\\Windows\\CurrentVersion\\SideBySide\\AssemblyStorageRoots\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\MACHINE\\System\\CurrentControlSet\\Control\\Session Manager\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Nls\\CustomLocale\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Srp\\GP\\DLL\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\")\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Session Manager\\kernel\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\SOFTWARE\\Microsoft\\windows nt\\CurrentVersion\\Image File Execution Options\\\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\System\\CurrentControlSet\\Services\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateChange\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\StateChange\\PackageList\\%ws\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Compatibility Assistant\\\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\Software\\Microsoft\\SQMClient\\Windows\\WMR\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Escalation\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Software\\Microsoft\\Windows\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\MACHINE\\System\\CurrentControlSet\\Control\\Session Manager\\Safe Load Prefixes\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\CMF\\SQMData\\BootLanguages\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\ProductOptions\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\ValidationRunlevels\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Segment Heap\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\CommonGlobUserSettings\\\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"System\\CurrentControlSet\\Control\\CMF\\LatestIndex\" in Source: 00000000-00007376.00000000.113264.77C61000.00000020.mdmp"}],"origin":"Memory Dumps","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-7","type":6,"relevance":1,"name":"Loads modules at runtime","description":"\"regsvr32.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 778f0000\n \"regsvr32.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 778f0000\n \"regsvr32.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 778f0000\n \"regsvr32.exe\" loaded module \"KERNEL32\" at base 770a0000\n \"regsvr32.exe\" loaded module \"EXT-MS-WIN-COM-OLE32-L1-1-0.DLL\" at base 777d0000\n \"regsvr32.exe\" loaded module \"%WINDIR%\\SYSTEM32\\UXTHEME.DLL\" at base 74040000\n \"regsvr32.exe\" loaded module \"C:\\X.EXE.DLL\" at base d00000\n \"regsvr32.exe\" loaded module \"KERNEL32.DLL\" at base 770a0000","description_v2":["\"regsvr32.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 778f0000","\"regsvr32.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 778f0000","\"regsvr32.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 778f0000","\"regsvr32.exe\" loaded module \"KERNEL32\" at base 770a0000","\"regsvr32.exe\" loaded module \"EXT-MS-WIN-COM-OLE32-L1-1-0.DLL\" at base 777d0000","\"regsvr32.exe\" loaded module \"%WINDIR%\\SYSTEM32\\UXTHEME.DLL\" at base 74040000","\"regsvr32.exe\" loaded module \"C:\\X.EXE.DLL\" at base d00000","\"regsvr32.exe\" loaded module \"KERNEL32.DLL\" at base 770a0000"],"description_v3":[{"type":"text","value":"\"regsvr32.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 778f0000"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 778f0000"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 778f0000"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" loaded module \"KERNEL32\" at base 770a0000"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" loaded module \"EXT-MS-WIN-COM-OLE32-L1-1-0.DLL\" at base 777d0000"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" loaded module \"%WINDIR%\\SYSTEM32\\UXTHEME.DLL\" at base 74040000"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" loaded module \"C:\\X.EXE.DLL\" at base d00000"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" loaded module \"KERNEL32.DLL\" at base 770a0000"}],"origin":"API Call","attck_id":"T1129","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1129","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"module-9","type":10,"relevance":0,"name":"Loads the Bcrypt module DLL","description":"\"regsvr32.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74840000\n \"regsvr32.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73450000","description_v2":["\"regsvr32.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74840000","\"regsvr32.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73450000"],"description_v3":[{"type":"text","value":"\"regsvr32.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74840000"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73450000"}],"origin":"Loaded Module","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"module-10","type":10,"relevance":0,"name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"regsvr32.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76D70000","description_v2":["\"regsvr32.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76D70000"],"description_v3":[{"type":"text","value":"\"regsvr32.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76D70000"}],"origin":"Loaded Module","attck_id":"T1129","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1129","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-157","type":0,"relevance":0,"name":"Matched Compiler/Packer signature (DIE)","description":"\"x.exe\" was detected as \".NET\" and name: \"Library\"\n \"x.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","description_v2":["\"x.exe\" was detected as \".NET\" and name: \"Library\"","\"x.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\""],"description_v3":[{"type":"text","value":"\"x.exe\" was detected as \".NET\" and name: \"Library\""},{"type":"linebreak"},{"type":"text","value":"\"x.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\""}],"origin":"Static Parser","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-144","type":0,"relevance":1,"name":"PE file contains COM data directory","description":"\"x.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","description_v2":["\"x.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\""],"description_v3":[{"type":"text","value":"\"x.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\""}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-80","type":0,"relevance":1,"name":"PE file contains executable sections","description":"\"x.exe\" has an executable section named \".text\"","description_v2":["\"x.exe\" has an executable section named \".text\""],"description_v3":[{"type":"text","value":"\"x.exe\" has an executable section named \".text\""}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-96","type":0,"relevance":0,"name":"PE file entrypoint instructions","description":"$9d","description_v2":["$9e"],"description_v3":[{"type":"text","value":"$9f"}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"target-67","type":9,"relevance":10,"name":"Process launched with changed environment","description":"Process \"regsvr32.exe\" (UID: 00000000-00007376) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"regsvr32.exe\" (UID: 00000000-00007376) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"","description_v2":["Process \"regsvr32.exe\" (UID: 00000000-00007376) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"","Process \"regsvr32.exe\" (UID: 00000000-00007376) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\""],"description_v3":[{"type":"text","value":"Process \"regsvr32.exe\""},{"type":"process","process_uid":"00000000-00007376","label":"Show Process"},{"type":"text","value":"was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\""},{"type":"linebreak"},{"type":"text","value":"Process \"regsvr32.exe\""},{"type":"process","process_uid":"00000000-00007376","label":"Show Process"},{"type":"text","value":"was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\""}],"origin":"Monitored Target","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"registry-25","type":3,"relevance":3,"name":"Reads information about supported languages","description":"\"regsvr32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"regsvr32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"regsvr32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","description_v2":["\"regsvr32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")","\"regsvr32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")","\"regsvr32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")"],"description_v3":[{"type":"text","value":"\"regsvr32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")"}],"origin":"Registry Access","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-153","type":0,"relevance":0,"name":"Uses 32 bit executable PE","description":"\"x.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","description_v2":["\"x.exe\" has flags like IMAGE_FILE_32BIT_MACHINE","IMAGE_FILE_EXECUTABLE"],"description_v3":[{"type":"text","value":"\"x.exe\" has flags like IMAGE_FILE_32BIT_MACHINE"},{"type":"linebreak"},{"type":"text","value":"IMAGE_FILE_EXECUTABLE"}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"string-548","type":2,"relevance":1,"name":"Contains ability to access the loader directly (API string)","description":"Found reference to API \"LdrLoadDll\" (Indicator: \"LdrLoadDll\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")\n Found reference to API \"LdrGetDllHandle\" (Indicator: \"LdrGetDllHandle\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778E3000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")","description_v2":["Found reference to API \"LdrLoadDll\" (Indicator: \"LdrLoadDll\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")","Found reference to API \"LdrGetDllHandle\" (Indicator: \"LdrGetDllHandle\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778E3000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"LdrLoadDll\" (Indicator: \"LdrLoadDll\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LdrGetDllHandle\" (Indicator: \"LdrGetDllHandle\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778E3000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1129","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1129","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"string-199","type":2,"relevance":1,"name":"Contains ability to create a service (API string)","description":"$a0","description_v2":["Found reference to API \"hook_CreateServiceA\" (Indicator: \"CreateService\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"hook_CreateServiceW\" (Indicator: \"CreateService\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"CreateServiceA\" (Indicator: \"CreateService\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.74BC1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"CreateServiceW\" (Indicator: \"CreateService\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"RtlCreateServiceSid\" (Indicator: \"CreateService\"; Source: \"00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"hook_CreateServiceA\" (Indicator: \"CreateService\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"hook_CreateServiceW\" (Indicator: \"CreateService\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateServiceA\" (Indicator: \"CreateService\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.74BC1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateServiceW\" (Indicator: \"CreateService\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RtlCreateServiceSid\" (Indicator: \"CreateService\"; Source: \"00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1543.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1543/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"string-422","type":2,"relevance":1,"name":"Contains ability to load malicious DLLs at startup using print spooler service (API string)","description":"Found reference to API \"GetPrintProcessorDirectoryW\" (Indicator: \"GetPrintProcessorDirectory\"; Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")\n Found reference to API \"AddPrintProcessorW\" (Indicator: \"AddPrintProcessor\"; Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")\n Found reference to API \"AddPrintProcessorA\" (Indicator: \"AddPrintProcessor\"; Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp\")\n Found reference to API \"GetPrintProcessorDirectoryA\" (Indicator: \"GetPrintProcessorDirectory\"; Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp\")","description_v2":["Found reference to API \"GetPrintProcessorDirectoryW\" (Indicator: \"GetPrintProcessorDirectory\"; Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"AddPrintProcessorW\" (Indicator: \"AddPrintProcessor\"; Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"AddPrintProcessorA\" (Indicator: \"AddPrintProcessor\"; Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp\")","Found reference to API \"GetPrintProcessorDirectoryA\" (Indicator: \"GetPrintProcessorDirectory\"; Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetPrintProcessorDirectoryW\" (Indicator: \"GetPrintProcessorDirectory\"; Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"AddPrintProcessorW\" (Indicator: \"AddPrintProcessor\"; Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"AddPrintProcessorA\" (Indicator: \"AddPrintProcessor\"; Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetPrintProcessorDirectoryA\" (Indicator: \"GetPrintProcessorDirectory\"; Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1547.012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1547/012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"string-310","type":2,"relevance":1,"name":"Contains ability to load modules (API string)","description":"$a1","description_v2":["$a2","$a3","Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"LoadLibraryCWD\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_ForceDXSetupSuccess::APIHook_LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_ForceDXSetupSuccess::APIHook_LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_ForceDXSetupSuccess::APIHook_LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_ForceDXSetupSuccess::APIHook_LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_LoadLibraryCWD::NotifyFn\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_LoadLibraryCWD::InitializeHooksMulti\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"$a4"},{"type":"linebreak"},{"type":"text","value":"$a5"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryCWD\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_ForceDXSetupSuccess::APIHook_LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_ForceDXSetupSuccess::APIHook_LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_ForceDXSetupSuccess::APIHook_LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_ForceDXSetupSuccess::APIHook_LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_LoadLibraryCWD::NotifyFn\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_LoadLibraryCWD::InitializeHooksMulti\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"string-255","type":2,"relevance":1,"name":"Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)","description":"Found reference to API \"NtQueueApcThread\" (Indicator: \"QueueApcThread\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")","description_v2":["Found reference to API \"NtQueueApcThread\" (Indicator: \"QueueApcThread\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"NtQueueApcThread\" (Indicator: \"QueueApcThread\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1055.004","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1055/004","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"string-421","type":2,"relevance":1,"name":"Contains ability to setup port monitor (API string)","description":"Found reference to API \"AddMonitorW\" (Indicator: \"AddMonitor\"; Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")\n Found reference to API \"AddMonitorA\" (Indicator: \"AddMonitor\"; Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp\")","description_v2":["Found reference to API \"AddMonitorW\" (Indicator: \"AddMonitor\"; Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"AddMonitorA\" (Indicator: \"AddMonitor\"; Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"AddMonitorW\" (Indicator: \"AddMonitor\"; Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"AddMonitorA\" (Indicator: \"AddMonitor\"; Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1547.010","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1547/010","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"registry-177","type":3,"relevance":1,"name":"Opens registry keys","description":"$a6","description_v2":["\"regsvr32.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\\SEGMENT HEAP\"; Key: \"\"; Value: \"\")","\"regsvr32.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\"; Key: \"\"; Value: \"\")","\"regsvr32.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WOW64\\X86\"; Key: \"\"; Value: \"\")","\"regsvr32.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SAFEBOOT\\OPTION\"; Key: \"\"; Value: \"\")","\"regsvr32.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SRP\\GP\\DLL\"; Key: \"\"; Value: \"\")","\"regsvr32.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"\"; Value: \"\")","\"regsvr32.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"\"; Value: \"\")","\"regsvr32.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\FILESYSTEM\"; Key: \"\"; Value: \"\")","\"regsvr32.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\APPCOMPATFLAGS\"; Key: \"\"; Value: \"\")","\"regsvr32.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\SHELL FOLDERS\"; Key: \"\"; Value: \"\")","\"regsvr32.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"\"; Value: \"\")"],"description_v3":[{"type":"text","value":"\"regsvr32.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\\SEGMENT HEAP\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WOW64\\X86\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SAFEBOOT\\OPTION\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SRP\\GP\\DLL\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\FILESYSTEM\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\APPCOMPATFLAGS\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\SHELL FOLDERS\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"\"; Value: \"\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"binary-91","type":8,"relevance":5,"name":"Potential hijacking of DLL execution flow detected","description":"\"sample.bin\" has type \"PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows 3 sections\"- [targetUID: N/A]","description_v2":["\"sample.bin\" has type \"PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows 3 sections\"- [targetUID: N/A]"],"description_v3":[{"type":"text","value":"\"sample.bin\" has type \"PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows 3 sections\"- [targetUID: N/A]"}],"origin":"Binary File","attck_id":"T1574.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1574/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-235","type":6,"relevance":1,"name":"Queries basic information of the specified process","description":"\"regsvr32.exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\regsvr32.exe\" (UID: 7376)","description_v2":["\"regsvr32.exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\regsvr32.exe\" (UID: 7376)"],"description_v3":[{"type":"text","value":"\"regsvr32.exe\" queries basic process information of the \"%WINDIR%\\SysWOW64\\regsvr32.exe\" (UID: 7376)"}],"origin":"API Call","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"registry-172","type":3,"relevance":1,"name":"Queries registry keys","description":"$a7","description_v2":["\"regsvr32.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\"; Key: \"RESOURCEPOLICIES\"; Value: \"\")","\"regsvr32.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WOW64\\X86\"; Key: \"REGSVR32.EXE\"; Value: \"\")","\"regsvr32.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WOW64\\X86\"; Key: \"\"; Value: \"\")","\"regsvr32.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\"; Value: \"\")","\"regsvr32.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\FILESYSTEM\"; Key: \"LONGPATHSENABLED\"; Value: \"\")","\"regsvr32.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\APPCOMPATFLAGS\"; Key: \"LOGFLAGS\"; Value: \"\")","\"regsvr32.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\APPCOMPATFLAGS\"; Key: \"SHOWDEBUGINFO\"; Value: \"\")","\"regsvr32.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\SHELL FOLDERS\"; Key: \"CACHE\"; Value: \"\")","\"regsvr32.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\"; Value: \"\")","\"regsvr32.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\"; Value: \"\")","\"regsvr32.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\MUI\\UILANGUAGES\\EN-US\"; Key: \"TYPE\"; Value: \"\")","\"regsvr32.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\MUI\\UILANGUAGES\\EN-US\"; Key: \"ALTERNATECODEPAGE\"; Value: \"\")","\"regsvr32.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\"; Key: \"PREFERREDUILANGUAGES\"; Value: \"\")","\"regsvr32.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\\MUICACHED\"; Key: \"MACHINEPREFERREDUILANGUAGES\"; Value: \"\")","\"regsvr32.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\SORTING\\VERSIONS\"; Key: \"\"; Value: \"\")","\"regsvr32.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\LSA\\FIPSALGORITHMPOLICY\"; Key: \"ENABLED\"; Value: \"\")","\"regsvr32.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\LSA\"; Key: \"FIPSALGORITHMPOLICY\"; Value: \"\")","\"regsvr32.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\LSA\\FIPSALGORITHMPOLICY\"; Key: \"MDMENABLED\"; Value: \"\")","\"regsvr32.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\OLE\"; Key: \"PAGEALLOCATORUSESYSTEMHEAP\"; Value: \"\")","\"regsvr32.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\OLE\"; Key: \"PAGEALLOCATORSYSTEMHEAPISPRIVATE\"; Value: \"\")"],"description_v3":[{"type":"text","value":"\"regsvr32.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\"; Key: \"RESOURCEPOLICIES\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WOW64\\X86\"; Key: \"REGSVR32.EXE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WOW64\\X86\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\FILESYSTEM\"; Key: \"LONGPATHSENABLED\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\APPCOMPATFLAGS\"; Key: \"LOGFLAGS\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\APPCOMPATFLAGS\"; Key: \"SHOWDEBUGINFO\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\SHELL FOLDERS\"; Key: \"CACHE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\MUI\\UILANGUAGES\\EN-US\"; Key: \"TYPE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\MUI\\UILANGUAGES\\EN-US\"; Key: \"ALTERNATECODEPAGE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\"; Key: \"PREFERREDUILANGUAGES\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\\MUICACHED\"; Key: \"MACHINEPREFERREDUILANGUAGES\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\SORTING\\VERSIONS\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\LSA\\FIPSALGORITHMPOLICY\"; Key: \"ENABLED\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\LSA\"; Key: \"FIPSALGORITHMPOLICY\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\LSA\\FIPSALGORITHMPOLICY\"; Key: \"MDMENABLED\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\OLE\"; Key: \"PAGEALLOCATORUSESYSTEMHEAP\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\OLE\"; Key: \"PAGEALLOCATORSYSTEMHEAPISPRIVATE\"; Value: \"\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"string-530","type":2,"relevance":1,"name":"References PATH environment registry keys","description":"Found string \"HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")\n Found string \"System\\CurrentControlSet\\Control\\Session Manager\\Environment\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.77071000.00000020.mdmp\")","description_v2":["Found string \"HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found string \"System\\CurrentControlSet\\Control\\Session Manager\\Environment\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.77071000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"System\\CurrentControlSet\\Control\\Session Manager\\Environment\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.77071000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1574.007","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1574/007","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"string-410","type":2,"relevance":1,"name":"References user shell folders registry key string","description":"Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\" (Indicator: \"currentversion\\explorer\\user shell folders\"; in Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","description_v2":["Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\" (Indicator: \"currentversion\\explorer\\user shell folders\"; in Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\" (Indicator: \"currentversion\\explorer\\user shell folders\"; in Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1547.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1547/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"summary-29","type":15,"relevance":1,"name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Able to identify virtual/sandbox environment\n Matched sigs: Able to identify sandbox environment running process\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Contains ability to detect presence of virtual environment (API string)\n Matched sigs: Able to identify virtual environment using user register activity\n Matched sigs: Contains ability to detect virtual environment (API)\n Matched sigs: Contains ability to delay the execution of current thread","description_v2":["The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)","Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)","Matched sigs: Able to identify virtual environment by using user activity (API string)","Matched sigs: Able to identify virtual/sandbox environment","Matched sigs: Able to identify sandbox environment running process","Matched sigs: Able to identify virtual environment by using API string","Matched sigs: Contains ability to detect presence of virtual environment (API string)","Matched sigs: Able to identify virtual environment using user register activity","Matched sigs: Contains ability to detect virtual environment (API)","Matched sigs: Contains ability to delay the execution of current thread"],"description_v3":[{"type":"text","value":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Able to identify virtual environment by using user activity (API string)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Able to identify virtual/sandbox environment"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Able to identify sandbox environment running process"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Able to identify virtual environment by using API string"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to detect presence of virtual environment (API string)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Able to identify virtual environment using user register activity"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to detect virtual environment (API)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to delay the execution of current thread"}],"origin":"Indicator Combinations","attck_id":"T1480","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1480","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-263","type":6,"relevance":1,"name":"Touches files","description":"\"regsvr32.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"regsvr32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"regsvr32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\regsvr32.exe\"\n \"regsvr32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"regsvr32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"regsvr32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"regsvr32.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"regsvr32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\AcLayers.dll\"\n \"regsvr32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\mpr.dll\"\n \"regsvr32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\sfc.dll\"\n \"regsvr32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\winspool.drv\"","description_v2":["\"regsvr32.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"","\"regsvr32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"","\"regsvr32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\regsvr32.exe\"","\"regsvr32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"","\"regsvr32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"","\"regsvr32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"","\"regsvr32.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"","\"regsvr32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\AcLayers.dll\"","\"regsvr32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\mpr.dll\"","\"regsvr32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\sfc.dll\"","\"regsvr32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\winspool.drv\""],"description_v3":[{"type":"text","value":"\"regsvr32.exe\" trying to touch file \"%WINDIR%\\System32\\WOW64LOG.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\""},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\regsvr32.exe\""},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\""},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\""},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\""},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\""},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\AcLayers.dll\""},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\mpr.dll\""},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\sfc.dll\""},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\winspool.drv\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-126","type":6,"relevance":3,"name":"Tries to access non-existent files (executable)","description":"\"regsvr32.exe\" trying to access non-existent file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"regsvr32.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\RPCSS.DLL\"\n \"regsvr32.exe\" trying to access non-existent file \"C:\\WINDOWS\\system32\\rpcss.dll\"","description_v2":["\"regsvr32.exe\" trying to access non-existent file \"C:\\Windows\\System32\\WOW64LOG.DLL\"","\"regsvr32.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\RPCSS.DLL\"","\"regsvr32.exe\" trying to access non-existent file \"C:\\WINDOWS\\system32\\rpcss.dll\""],"description_v3":[{"type":"text","value":"\"regsvr32.exe\" trying to access non-existent file \"%WINDIR%\\System32\\WOW64LOG.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\RPCSS.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"regsvr32.exe\" trying to access non-existent file \"C:\\WINDOWS\\system32\\rpcss.dll\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-923","type":2,"relevance":1,"name":"Able to access Windows networking-related API (String)","description":"$a8","description_v2":["Found reference to API \"hook_WNetGetProviderNameA\" (Indicator: \"WNetGetProviderName\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"hook_WNetGetProviderNameW\" (Indicator: \"WNetGetProviderName\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"WNetGetProviderNameA\" (Indicator: \"WNetGetProviderName\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.746E1000.00000020.mdmp\")","Found reference to API \"WNetGetProviderNameW\" (Indicator: \"WNetGetProviderName\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.746E1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"WNetGetConnectionW\" (Indicator: \"WNetGetConnection\"; Source: \"00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.746E1000.00000020.mdmp, 00000000-00007376.00000000.113264.76501000.00000020.mdmp, 00000000-00007376.00000000.113264.76E61000.00000020.mdmp, 00000000-00007376.00000000.113264.777D1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"hook_WNetGetProviderNameA\" (Indicator: \"WNetGetProviderName\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"hook_WNetGetProviderNameW\" (Indicator: \"WNetGetProviderName\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WNetGetProviderNameA\" (Indicator: \"WNetGetProviderName\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.746E1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WNetGetProviderNameW\" (Indicator: \"WNetGetProviderName\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.746E1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WNetGetConnectionW\" (Indicator: \"WNetGetConnection\"; Source: \"00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.746E1000.00000020.mdmp, 00000000-00007376.00000000.113264.76501000.00000020.mdmp, 00000000-00007376.00000000.113264.76E61000.00000020.mdmp, 00000000-00007376.00000000.113264.777D1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1135","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1135","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-736","type":2,"relevance":1,"name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"$a9","description_v2":["Found reference to API \"hook_GetComputerNameExA\" (Indicator: \"getcomputernameexa\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"hook_GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"GetComputerNameExA\" (Indicator: \"getcomputernameexa\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"hook_GetComputerNameExA\" (Indicator: \"getcomputernameexa\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"hook_GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetComputerNameExA\" (Indicator: \"getcomputernameexa\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1016","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1016","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-740","type":2,"relevance":1,"name":"Contains Wi-Fi native api calls","description":"Found reference to API \"WlanEnumInterfaces\" (Indicator: \"WlanEnumInterfaces\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")\n Found reference to API \"WlanGetAvailableNetworkList\" (Indicator: \"WlanGetAvailableNetworkList\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","description_v2":["Found reference to API \"WlanEnumInterfaces\" (Indicator: \"WlanEnumInterfaces\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"WlanGetAvailableNetworkList\" (Indicator: \"WlanGetAvailableNetworkList\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"WlanEnumInterfaces\" (Indicator: \"WlanEnumInterfaces\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WlanGetAvailableNetworkList\" (Indicator: \"WlanGetAvailableNetworkList\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1016.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1016/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-228","type":2,"relevance":1,"name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74BC1000.00000020.mdmp, 00000000-00007376.00000000.113264.76D71000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","description_v2":["Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74BC1000.00000020.mdmp, 00000000-00007376.00000000.113264.76D71000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74BC1000.00000020.mdmp, 00000000-00007376.00000000.113264.76D71000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1095","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1095","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-601","type":2,"relevance":1,"name":"Contains ability to communicate with network (API string)","description":"$aa","description_v2":["Found reference to API \"hook_InternetOpenA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"hook_InternetOpenW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"hook_HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"hook_HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"hook_InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74BC1000.00000020.mdmp, 00000000-00007376.00000000.113264.76D71000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"WinHttpConnect\" (Indicator: \"WinHttpConnect\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"WinHttpOpenRequest\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"WinHttpOpenRequest\" (Indicator: \"WinHttpOpenRequest\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"WinHttpSendRequest\" (Indicator: \"HttpSendRequest\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"WinHttpSendRequest\" (Indicator: \"WinHttpSendRequest\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"hook_InternetOpenA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"hook_InternetOpenW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"hook_HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"hook_HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"hook_InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74BC1000.00000020.mdmp, 00000000-00007376.00000000.113264.76D71000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WinHttpConnect\" (Indicator: \"WinHttpConnect\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WinHttpOpenRequest\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WinHttpOpenRequest\" (Indicator: \"WinHttpOpenRequest\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WinHttpSendRequest\" (Indicator: \"HttpSendRequest\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WinHttpSendRequest\" (Indicator: \"WinHttpSendRequest\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1071","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-538","type":2,"relevance":1,"name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")\n Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","description_v2":["Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1071","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-537","type":2,"relevance":1,"name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"hook_HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")\n Found reference to API \"hook_HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")\n Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")\n Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")\n Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","description_v2":["Found reference to API \"hook_HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"hook_HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"hook_HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"hook_HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1071","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-210","type":2,"relevance":1,"name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreateNamedPipeA\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")\n Found reference to API \"CreateNamedPipeW\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","description_v2":["Found reference to API \"CreateNamedPipeA\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"CreateNamedPipeW\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CreateNamedPipeA\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateNamedPipeW\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1559","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1559","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-241","type":2,"relevance":1,"name":"Contains ability to download a file from a URL (API string)","description":"$ab","description_v2":["Found reference to API \"hook_InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"hook_URLDownloadToFileA\" (Indicator: \"URLDownloadToFile\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"hook_URLDownloadToFileA\" (Indicator: \"URLDownload\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"hook_URLDownloadToFileW\" (Indicator: \"URLDownloadToFile\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"hook_URLDownloadToFileW\" (Indicator: \"URLDownload\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"URLDownloadToFileA\" (Indicator: \"URLDownloadToFile\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"URLDownloadToFileA\" (Indicator: \"URLDownload\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"URLDownloadToFileW\" (Indicator: \"URLDownloadToFile\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"URLDownloadToFileW\" (Indicator: \"URLDownload\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"hook_InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"hook_URLDownloadToFileA\" (Indicator: \"URLDownloadToFile\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"hook_URLDownloadToFileA\" (Indicator: \"URLDownload\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"hook_URLDownloadToFileW\" (Indicator: \"URLDownloadToFile\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"hook_URLDownloadToFileW\" (Indicator: \"URLDownload\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"URLDownloadToFileA\" (Indicator: \"URLDownloadToFile\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"URLDownloadToFileA\" (Indicator: \"URLDownload\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"URLDownloadToFileW\" (Indicator: \"URLDownloadToFile\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"URLDownloadToFileW\" (Indicator: \"URLDownload\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1105","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1105","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-257","type":2,"relevance":1,"name":"Contains ability to enumerate network resources (API string)","description":"Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.746E1000.00000020.mdmp, 00000000-00007376.00000000.113264.76501000.00000020.mdmp, 00000000-00007376.00000000.113264.76E61000.00000020.mdmp, 00000000-00007376.00000000.113264.777D1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","description_v2":["Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.746E1000.00000020.mdmp, 00000000-00007376.00000000.113264.76501000.00000020.mdmp, 00000000-00007376.00000000.113264.76E61000.00000020.mdmp, 00000000-00007376.00000000.113264.777D1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.746E1000.00000020.mdmp, 00000000-00007376.00000000.113264.76501000.00000020.mdmp, 00000000-00007376.00000000.113264.76E61000.00000020.mdmp, 00000000-00007376.00000000.113264.777D1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1049","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1049","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-190","type":2,"relevance":3,"name":"Contains ability to query information about shared network resources (API string)","description":"Found reference to API \"EnumPrintersW level 4 failed\" (Indicator: \"EnumPrinters\"; Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp\")\n Found reference to API \"EnumPrintersW\" (Indicator: \"EnumPrinters\"; Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")\n Found reference to API \"EnumPrintersA\" (Indicator: \"EnumPrinters\"; Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","description_v2":["Found reference to API \"EnumPrintersW level 4 failed\" (Indicator: \"EnumPrinters\"; Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp\")","Found reference to API \"EnumPrintersW\" (Indicator: \"EnumPrinters\"; Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"EnumPrintersA\" (Indicator: \"EnumPrinters\"; Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"EnumPrintersW level 4 failed\" (Indicator: \"EnumPrinters\"; Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"EnumPrintersW\" (Indicator: \"EnumPrinters\"; Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"EnumPrintersA\" (Indicator: \"EnumPrinters\"; Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1135","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1135","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-112","type":2,"relevance":1,"name":"Contains ability to retrieve information about user accounts on a server (API string)","description":"Found reference to API \"NetUserSetInfo\" (Indicator: \"NetUserSetInfo\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")\n Found reference to API \"NetUserGetInfo\" (Indicator: \"NetUserGetInfo\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","description_v2":["Found reference to API \"NetUserSetInfo\" (Indicator: \"NetUserSetInfo\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"NetUserGetInfo\" (Indicator: \"NetUserGetInfo\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"NetUserSetInfo\" (Indicator: \"NetUserSetInfo\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NetUserGetInfo\" (Indicator: \"NetUserGetInfo\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1087.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1087/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-314","type":2,"relevance":1,"name":"Contains ability to retrieve internet settings (API string)","description":"Found reference to API \"InternetQueryOptionA\" (Indicator: \"InternetQueryOption\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")\n Found reference to API \"InternetQueryOptionW\" (Indicator: \"InternetQueryOption\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","description_v2":["Found reference to API \"InternetQueryOptionA\" (Indicator: \"InternetQueryOption\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"InternetQueryOptionW\" (Indicator: \"InternetQueryOption\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"InternetQueryOptionA\" (Indicator: \"InternetQueryOption\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"InternetQueryOptionW\" (Indicator: \"InternetQueryOption\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1016","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1016","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-453","type":2,"relevance":1,"name":"Contains ability to set options for internet handles (API string)","description":"Found reference to API \"InternetSetOptionA\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")\n Found reference to API \"InternetSetOptionW\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")\n Found reference to API \"NS_HandleBadPtr::APIHook_InternetSetOptionA\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")\n Found reference to API \"NS_HandleBadPtr::APIHook_InternetSetOptionW\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","description_v2":["Found reference to API \"InternetSetOptionA\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"InternetSetOptionW\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"NS_HandleBadPtr::APIHook_InternetSetOptionA\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_HandleBadPtr::APIHook_InternetSetOptionW\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"InternetSetOptionA\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"InternetSetOptionW\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_HandleBadPtr::APIHook_InternetSetOptionA\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_HandleBadPtr::APIHook_InternetSetOptionW\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1071.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-323","type":2,"relevance":1,"name":"Contains reference to Windows HTTP services (API string)","description":"Found reference to API \"WinHttpConnect\" (Indicator: \"WinHttpConnect\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")\n Found reference to API \"WinHttpOpenRequest\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")\n Found reference to API \"WinHttpOpenRequest\" (Indicator: \"WinHttpOpenRequest\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")\n Found reference to API \"WinHttpSendRequest\" (Indicator: \"WinHttpSendRequest\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")\n Found reference to API \"WinHttpReceiveResponse\" (Indicator: \"WinHttpReceiveResponse\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","description_v2":["Found reference to API \"WinHttpConnect\" (Indicator: \"WinHttpConnect\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"WinHttpOpenRequest\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"WinHttpOpenRequest\" (Indicator: \"WinHttpOpenRequest\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"WinHttpSendRequest\" (Indicator: \"WinHttpSendRequest\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"WinHttpReceiveResponse\" (Indicator: \"WinHttpReceiveResponse\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"WinHttpConnect\" (Indicator: \"WinHttpConnect\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WinHttpOpenRequest\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WinHttpOpenRequest\" (Indicator: \"WinHttpOpenRequest\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WinHttpSendRequest\" (Indicator: \"WinHttpSendRequest\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WinHttpReceiveResponse\" (Indicator: \"WinHttpReceiveResponse\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1071.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-539","type":2,"relevance":1,"name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"hook_InternetOpenA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")\n Found reference to API \"hook_InternetOpenW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")\n Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")\n Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","description_v2":["Found reference to API \"hook_InternetOpenA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"hook_InternetOpenW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"hook_InternetOpenA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"hook_InternetOpenW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1071.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-899","type":2,"relevance":1,"name":"Contains references to network communication API (string)","description":"Found reference to API \"hook_gethostname\" (Indicator: \"gethostname\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")\n Found reference to API \"gethostname\" (Indicator: \"gethostname\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74BC1000.00000020.mdmp\")\n Found reference to API \"Client failed to connect to the FTH pipe.\" (Indicator: \" connect \"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")\n Found reference to API \"Failed to connect engine to loader\" (Indicator: \" connect \"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp\")","description_v2":["Found reference to API \"hook_gethostname\" (Indicator: \"gethostname\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"gethostname\" (Indicator: \"gethostname\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74BC1000.00000020.mdmp\")","Found reference to API \"Client failed to connect to the FTH pipe.\" (Indicator: \" connect \"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"Failed to connect engine to loader\" (Indicator: \" connect \"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"hook_gethostname\" (Indicator: \"gethostname\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"gethostname\" (Indicator: \"gethostname\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74BC1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Client failed to connect to the FTH pipe.\" (Indicator: \" connect \"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Failed to connect engine to loader\" (Indicator: \" connect \"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1071","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-169","type":2,"relevance":1,"name":"Found mail related domain names","description":"Observed email domain:\"pop.\" [Source: 00000000-00007376.00000000.113264.00320000.00000002.mdmp]","description_v2":["Observed email domain:\"pop.\" [Source: 00000000-00007376.00000000.113264.00320000.00000002.mdmp]"],"description_v3":[{"type":"text","value":"Observed email domain:\"pop.\" [Source: 00000000-00007376.00000000.113264.00320000.00000002.mdmp]"}],"origin":"File/Memory","attck_id":"T1071.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-14","type":2,"relevance":0,"name":"Found potential IP address in binary/memory","description":"$ac","description_v2":["\"0.0.0.0\"","Potential IP \"15.0.0.0\" found in string \"HKCR\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\InprocServer32\\15.0.0.0\"","Potential IP \"15.0.0.0\" found in string \"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\InprocServer32\\15.0.0.0\"","Potential IP \"15.0.0.0\" found in string \"HKCR\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\InprocServer32\\15.0.0.0\"","Potential IP \"15.0.0.0\" found in string \"HKCR\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\InprocServer32\\15.0.0.0\"","Potential IP \"15.0.0.0\" found in string \"HKLM\\SOFTWARE\\Classes\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\InprocServer32\\15.0.0.0\"","Potential IP \"15.0.0.0\" found in string \"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\InprocServer32\\15.0.0.0\"","Potential IP \"15.0.0.0\" found in string \"HKCR\\WOW6432Node\\CLSID\\{000209FF-0000-0000-C000-000000000046}\\InprocServer32\\15.0.0.0\"","Potential IP \"15.0.0.0\" found in string \"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{000209FF-0000-0000-C000-000000000046}\\InprocServer32\\15.0.0.0\""],"description_v3":[{"type":"text","value":"\"0.0.0.0\""},{"type":"linebreak"},{"type":"text","value":"Potential IP \"15.0.0.0\" found in string \"HKCR\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\InprocServer32\\15.0.0.0\""},{"type":"linebreak"},{"type":"text","value":"Potential IP \"15.0.0.0\" found in string \"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00024500-0000-0000-C000-000000000046}\\InprocServer32\\15.0.0.0\""},{"type":"linebreak"},{"type":"text","value":"Potential IP \"15.0.0.0\" found in string \"HKCR\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\InprocServer32\\15.0.0.0\""},{"type":"linebreak"},{"type":"text","value":"Potential IP \"15.0.0.0\" found in string \"HKCR\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\InprocServer32\\15.0.0.0\""},{"type":"linebreak"},{"type":"text","value":"Potential IP \"15.0.0.0\" found in string \"HKLM\\SOFTWARE\\Classes\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\InprocServer32\\15.0.0.0\""},{"type":"linebreak"},{"type":"text","value":"Potential IP \"15.0.0.0\" found in string \"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{91493441-5A91-11CF-8700-00AA0060263B}\\InprocServer32\\15.0.0.0\""},{"type":"linebreak"},{"type":"text","value":"Potential IP \"15.0.0.0\" found in string \"HKCR\\WOW6432Node\\CLSID\\{000209FF-0000-0000-C000-000000000046}\\InprocServer32\\15.0.0.0\""},{"type":"linebreak"},{"type":"text","value":"Potential IP \"15.0.0.0\" found in string \"HKLM\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{000209FF-0000-0000-C000-000000000046}\\InprocServer32\\15.0.0.0\""}],"origin":"File/Memory","attck_id":"T1071","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-3","type":2,"relevance":3,"name":"Found potential URL in binary/memory","description":"Heuristic match: \"dd.mm\"\n Heuristic match: \"hh.mm\"\n Heuristic match: \"tt hh.mm\"\n Heuristic match: \"tt h.mm\"\n Heuristic match: \"'kl'. h.mm\"\n Pattern match: \"http://www.w3.org/2001/xmlschema-instance\"\n Pattern match: \"http://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/events\"\n Heuristic match: \"%windir%\\system32\\tm20dec.ax\"\n Heuristic match: \"%windir%\\system32\\iac25_32.ax\"\n Heuristic match: \"ir41_32.ax\"\n Heuristic match: \"%windir%\\system32\\ir41_32.ax\"\n Heuristic match: \"c:\\pdoxusrs.net\"\n Heuristic match: \"%localappdata%\\pdoxusrs.net\"\n Heuristic match: \"\\microsoft.net\"\n Heuristic match: \"_[hh.it\"\n Heuristic match: \"h(.it\"\n Heuristic match: \"hh.it\"","description_v2":["Heuristic match: \"dd.mm\"","Heuristic match: \"hh.mm\"","Heuristic match: \"tt hh.mm\"","Heuristic match: \"tt h.mm\"","Heuristic match: \"'kl'. h.mm\"","Pattern match: \"http://www.w3.org/2001/xmlschema-instance\"","Pattern match: \"http://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/events\"","Heuristic match: \"%windir%\\system32\\tm20dec.ax\"","Heuristic match: \"%windir%\\system32\\iac25_32.ax\"","Heuristic match: \"ir41_32.ax\"","Heuristic match: \"%windir%\\system32\\ir41_32.ax\"","Heuristic match: \"c:\\pdoxusrs.net\"","Heuristic match: \"%localappdata%\\pdoxusrs.net\"","Heuristic match: \"\\microsoft.net\"","Heuristic match: \"_[hh.it\"","Heuristic match: \"h(.it\"","Heuristic match: \"hh.it\""],"description_v3":[{"type":"text","value":"Heuristic match: \"dd.mm\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"hh.mm\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"tt hh.mm\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"tt h.mm\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"'kl'. h.mm\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.w3.org/2001/xmlschema-instance\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/events\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"%windir%\\system32\\tm20dec.ax\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"%windir%\\system32\\iac25_32.ax\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"ir41_32.ax\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"%windir%\\system32\\ir41_32.ax\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"c:\\pdoxusrs.net\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"%localappdata%\\pdoxusrs.net\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"\\microsoft.net\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"_[hh.it\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"h(.it\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"hh.it\""}],"origin":"File/Memory","attck_id":"T1071","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"memorydump-2","type":20,"relevance":1,"name":"Found potential URLs in memory dumps","description":"$ad","description_v2":["Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00007376.00000000.113264.00680000.00000004.mdmp\")","Found URL \"http://https://user\" - Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp\")","$ae","Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp\")","Found URL \"http://www.w3.org/xml/1998/namespaceindexed\\settings\\xpathopenmetadatakeyinxmlattributeopenmetadatavalueoverridetextcontentadditionalcontentbinarycontenttargetnamespace=\" - Source: \"00000000-00007376.00000000.113264.74D81000.00000020.mdmp\")","Found URL \"http://software\\microsoft\\windows\\currentversion\\url\\defaultprefix%hs(%d)\\%hs!%p:\" - Source: \"00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found URL \"http://go.microsoft.com/fwlink/?linkid=228610\" - Source: \"00000000-00007376.00000000.113264.77D79000.00000002.mdmp\")","Found URL \"https://go.microsoft.com/fwlink/?linkid=851152\" - Source: \"00000000-00007376.00000000.113264.77D79000.00000002.mdmp\")","Found URL \"https://go.microsoft.com/fwlink/?linkid=852747the\" - Source: \"00000000-00007376.00000000.113264.77D79000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00007376.00000000.113264.00680000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://https://user\" - Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"$af"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.w3.org/xml/1998/namespaceindexed\\settings\\xpathopenmetadatakeyinxmlattributeopenmetadatavalueoverridetextcontentadditionalcontentbinarycontenttargetnamespace=\" - Source: \"00000000-00007376.00000000.113264.74D81000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://software\\microsoft\\windows\\currentversion\\url\\defaultprefix%hs(%d)\\%hs!%p:\" - Source: \"00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://go.microsoft.com/fwlink/?linkid=228610\" - Source: \"00000000-00007376.00000000.113264.77D79000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://go.microsoft.com/fwlink/?linkid=851152\" - Source: \"00000000-00007376.00000000.113264.77D79000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://go.microsoft.com/fwlink/?linkid=852747the\" - Source: \"00000000-00007376.00000000.113264.77D79000.00000002.mdmp\")"}],"origin":"Memory Dumps","attck_id":"T1071","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"summary-27","type":15,"relevance":2,"name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","description_v2":["Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network"],"description_v3":[{"type":"text","value":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network"}],"origin":"Indicator Combinations","attck_id":"T1119","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1119","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Pattern Matching","identifier":"yara-606","type":13,"relevance":5,"name":"YARA signature match - Medium entropy File","description":"YARA signature to detect medium entropy file process \"00000000-00007376\"","description_v2":["YARA signature to detect medium entropy file process \"00000000-00007376\""],"description_v3":[{"type":"text","value":"YARA signature to detect medium entropy file process \"00000000-00007376\""}],"origin":"YARA Signature","attck_id":"T1027.013","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027/013","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Pattern Matching","identifier":"yara-104","type":13,"relevance":0,"name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on process \"00000000-00007376\"","description_v2":["YARA signature for RC4 encryption matched on process \"00000000-00007376\""],"description_v3":[{"type":"text","value":"YARA signature for RC4 encryption matched on process \"00000000-00007376\""}],"origin":"YARA Signature","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Ransomware/Banking","identifier":"string-553","type":2,"relevance":1,"name":"Contains ability to modify file system redirection (API string)","description":"$b0","description_v2":["Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1070","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1070","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Remote Access Related","identifier":"string-454","type":2,"relevance":1,"name":"Contains ability to register RPC protocol sequence (API string)","description":"Found reference to API \"RpcServerUseProtseqEpW\" (Indicator: \"RpcServerUseProtseq\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76D71000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","description_v2":["Found reference to API \"RpcServerUseProtseqEpW\" (Indicator: \"RpcServerUseProtseq\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76D71000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"RpcServerUseProtseqEpW\" (Indicator: \"RpcServerUseProtseq\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76D71000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1021","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1021","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Remote Access Related","identifier":"string-546","type":2,"relevance":1,"name":"Contains ability to retrieve remote session information (API string)","description":"Found reference to API \"WTSQueryUserToken\" (Indicator: \"WTSQueryUserToken\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")\n Found reference to API \"WTSQuerySessionInformationA\" (Indicator: \"WTSQuerySessionInformation\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")\n Found reference to API \"WTSQuerySessionInformationW\" (Indicator: \"WTSQuerySessionInformation\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","description_v2":["Found reference to API \"WTSQueryUserToken\" (Indicator: \"WTSQueryUserToken\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"WTSQuerySessionInformationA\" (Indicator: \"WTSQuerySessionInformation\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"WTSQuerySessionInformationW\" (Indicator: \"WTSQuerySessionInformation\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"WTSQueryUserToken\" (Indicator: \"WTSQueryUserToken\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WTSQuerySessionInformationA\" (Indicator: \"WTSQuerySessionInformation\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WTSQuerySessionInformationW\" (Indicator: \"WTSQuerySessionInformation\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1018","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1018","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Remote Access Related","identifier":"string-531","type":2,"relevance":1,"name":"Contains references to RPC protocol sequence strings","description":"Found string \"ncalrpc\" (Indicator: \"ncalrpc\"; Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74741000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.74801000.00000020.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.76371000.00000020.mdmp, 00000000-00007376.00000000.113264.76D71000.00000020.mdmp, 00000000-00007376.00000000.113264.777D1000.00000020.mdmp\")\n Found string \"ncacn_ip_tcp\" (Indicator: \"ncacn_ip_tcp\"; Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp\")","description_v2":["Found string \"ncalrpc\" (Indicator: \"ncalrpc\"; Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74741000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.74801000.00000020.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.76371000.00000020.mdmp, 00000000-00007376.00000000.113264.76D71000.00000020.mdmp, 00000000-00007376.00000000.113264.777D1000.00000020.mdmp\")","Found string \"ncacn_ip_tcp\" (Indicator: \"ncacn_ip_tcp\"; Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"ncalrpc\" (Indicator: \"ncalrpc\"; Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74741000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.74801000.00000020.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.76371000.00000020.mdmp, 00000000-00007376.00000000.113264.76D71000.00000020.mdmp, 00000000-00007376.00000000.113264.777D1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"ncacn_ip_tcp\" (Indicator: \"ncacn_ip_tcp\"; Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1090","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1090","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-915","type":2,"relevance":1,"name":"Able to capture drag-drop file operations","description":"Found string \"GetClipboardData\" (Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","description_v2":["Found string \"GetClipboardData\" (Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"GetClipboardData\" (Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1115","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1115","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-730","type":2,"relevance":1,"name":"Able to determine the valid logical drives on the computer","description":"Found string \"hook_GetLogicalDriveStringsA\" (Indicator: \"getlogicaldrivestringsa\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")\n Found string \"hook_GetLogicalDriveStringsW\" (Indicator: \"getlogicaldrivestringsw\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")\n Found string \"GetLogicalDriveStringsA\" (Indicator: \"getlogicaldrivestringsa\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")\n Found string \"GetLogicalDriveStringsW\" (Indicator: \"getlogicaldrivestringsw\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","description_v2":["Found string \"hook_GetLogicalDriveStringsA\" (Indicator: \"getlogicaldrivestringsa\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found string \"hook_GetLogicalDriveStringsW\" (Indicator: \"getlogicaldrivestringsw\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found string \"GetLogicalDriveStringsA\" (Indicator: \"getlogicaldrivestringsa\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found string \"GetLogicalDriveStringsW\" (Indicator: \"getlogicaldrivestringsw\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"hook_GetLogicalDriveStringsA\" (Indicator: \"getlogicaldrivestringsa\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"hook_GetLogicalDriveStringsW\" (Indicator: \"getlogicaldrivestringsw\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"GetLogicalDriveStringsA\" (Indicator: \"getlogicaldrivestringsa\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"GetLogicalDriveStringsW\" (Indicator: \"getlogicaldrivestringsw\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-86","type":2,"relevance":1,"name":"Able to discover operating system information (API string)","description":"$b1","description_v2":["Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")","Found reference to API \"hook_RtlGetNtProductType\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"hook_RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"RtlGetNtProductType\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")","Found reference to API \"Exception in hook_RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"NS_VistaRTMVersionLie::APIHook_RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_VistaSP1VersionLie::APIHook_RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_VistaSP2VersionLie::APIHook_RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_Win2k3RTMVersionLie::APIHook_RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_Win2k3SP1VersionLie::APIHook_RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_Win7RTMVersionLie::APIHook_RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_Win8RTMVersionLie::APIHook_RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_Win81RTMVersionLie::APIHook_RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_WinXPSP1VersionLie::APIHook_RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_WinXPSP2VersionLie::APIHook_RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_WinXPSP3VersionLie::APIHook_RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_WinXPVersionLie::APIHook_RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"hook_RtlGetNtProductType\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"hook_RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RtlGetNtProductType\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Exception in hook_RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_VistaRTMVersionLie::APIHook_RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_VistaSP1VersionLie::APIHook_RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_VistaSP2VersionLie::APIHook_RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_Win2k3RTMVersionLie::APIHook_RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_Win2k3SP1VersionLie::APIHook_RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_Win7RTMVersionLie::APIHook_RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_Win8RTMVersionLie::APIHook_RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_Win81RTMVersionLie::APIHook_RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_WinXPSP1VersionLie::APIHook_RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_WinXPSP2VersionLie::APIHook_RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_WinXPSP3VersionLie::APIHook_RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_WinXPVersionLie::APIHook_RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-229","type":2,"relevance":1,"name":"Able to query registry keys (API string)","description":"$b2","description_v2":["Found registry query API: \"\" in \"00000000-00007376.00000000.113264.00680000.00000004.mdmp\"","Found registry query API: \"\" in \"00000000-00007376.00000000.113264.00680000.00000004.mdmp\"","$b3","$b4","$b5","Found registry query API: \"RegEnumKeyExA\" in \"00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\"","$b6","Found registry query API: \"RegQueryInfoKeyA\" in \"00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\"","Found registry query API: \"RegQueryValueExA\" in \"00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\"","Found registry query API: \"RegOpenCurrentUser\" in \"00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\"","Found registry query API: \"ProfilesRegQueryValueEx\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\"","Found registry query API: \"RegOpenKeyExA: wrp key is mitigated\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\"","Found registry query API: \"RegOpenKeyA\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\"","Found registry query API: \"RegOpenKeyW\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.777D1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\"","Found registry query API: \"RegOpenUserClassesRoot\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\"","Found registry query API: \"RegQueryValueA\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\"","Found registry query API: \"RegQueryValueW\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.74D81000.00000020.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.777D1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\"","Found registry query API: \"RegEnumValueA\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\"","Found registry query API: \"RegEnumValueW\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\"","Found registry query API: \"RegEnumKeyA\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\"","Found registry query API: \"RegEnumKeyW\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.74D81000.00000020.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\"","$b7","$b8","Found registry query API: \"RegGetValueA\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\"","Found registry query API: \"Unexpected error returned from RegEnumValueW %d\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\""],"description_v3":[{"type":"text","value":"Found registry query API: \"\" in \"00000000-00007376.00000000.113264.00680000.00000004.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found registry query API: \"\" in \"00000000-00007376.00000000.113264.00680000.00000004.mdmp\""},{"type":"linebreak"},{"type":"text","value":"$b9"},{"type":"linebreak"},{"type":"text","value":"$ba"},{"type":"linebreak"},{"type":"text","value":"$bb"},{"type":"linebreak"},{"type":"text","value":"Found registry query API: \"RegEnumKeyExA\" in \"00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\""},{"type":"linebreak"},{"type":"text","value":"$bc"},{"type":"linebreak"},{"type":"text","value":"Found registry query API: \"RegQueryInfoKeyA\" in \"00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found registry query API: \"RegQueryValueExA\" in \"00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.7472B000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found registry query API: \"RegOpenCurrentUser\" in \"00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found registry query API: \"ProfilesRegQueryValueEx\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found registry query API: \"RegOpenKeyExA: wrp key is mitigated\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found registry query API: \"RegOpenKeyA\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found registry query API: \"RegOpenKeyW\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.777D1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found registry query API: \"RegOpenUserClassesRoot\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found registry query API: \"RegQueryValueA\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found registry query API: \"RegQueryValueW\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.74D81000.00000020.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.777D1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found registry query API: \"RegEnumValueA\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found registry query API: \"RegEnumValueW\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.7475B000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found registry query API: \"RegEnumKeyA\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found registry query API: \"RegEnumKeyW\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.74D81000.00000020.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\""},{"type":"linebreak"},{"type":"text","value":"$bd"},{"type":"linebreak"},{"type":"text","value":"$be"},{"type":"linebreak"},{"type":"text","value":"Found registry query API: \"RegGetValueA\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\""},{"type":"linebreak"},{"type":"text","value":"Found registry query API: \"Unexpected error returned from RegEnumValueW %d\" in \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\""}],"origin":"File/Memory","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-88","type":2,"relevance":1,"name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"hook_GetAsyncKeyState\" (Indicator: \"GetAsyncKeyState\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")\n Found reference to API \"hook_GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")\n Found reference to API \"GetAsyncKeyState\" (Indicator: \"GetAsyncKeyState\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","description_v2":["Found reference to API \"hook_GetAsyncKeyState\" (Indicator: \"GetAsyncKeyState\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"hook_GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"GetAsyncKeyState\" (Indicator: \"GetAsyncKeyState\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"hook_GetAsyncKeyState\" (Indicator: \"GetAsyncKeyState\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"hook_GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetAsyncKeyState\" (Indicator: \"GetAsyncKeyState\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1056.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1056/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-904","type":2,"relevance":1,"name":"Able to retrieve name of the domain controller for the current domain (API string)","description":"Found domain controller discovery API reference: \"DsGetDcName\" in \"00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\"","description_v2":["Found domain controller discovery API reference: \"DsGetDcName\" in \"00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\""],"description_v3":[{"type":"text","value":"Found domain controller discovery API reference: \"DsGetDcName\" in \"00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\""}],"origin":"File/Memory","attck_id":"T1016","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1016","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"api-103","type":6,"relevance":3,"name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"regsvr32.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","description_v2":["\"regsvr32.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"","\"th32ProcessID\": \"0\"}"],"description_v3":[{"type":"text","value":"\"regsvr32.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\""},{"type":"linebreak"},{"type":"text","value":"\"th32ProcessID\": \"0\"}"}],"origin":"API Call","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-57","type":2,"relevance":3,"name":"Contains CRYPTO related strings","description":"$bf","description_v2":["Found string \"Guyanaese Dollar\" (Indicator: \"aes\"; Source: \"00000000-00007376.00000000.113264.00320000.00000002.mdmp\")","Found string \"ECDSA\" (Indicator: \"ecdsa\"; Source: \"00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.74841000.00000020.mdmp\")","Found string \"ECDSA_P256\" (Indicator: \"ecdsa\"; Source: \"00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.74841000.00000020.mdmp\")","Found string \"ECDSA_P384\" (Indicator: \"ecdsa\"; Source: \"00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.74841000.00000020.mdmp\")","Found string \"ECDSA_P521\" (Indicator: \"ecdsa\"; Source: \"00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.74841000.00000020.mdmp\")","Found string \"AES-GMAC\" (Indicator: \"aes\"; Source: \"00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.74841000.00000020.mdmp\")","Found string \"3DES\" (Indicator: \"3des\"; Source: \"00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.74841000.00000020.mdmp\")","Found string \"3DES_112\" (Indicator: \"3des\"; Source: \"00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.74841000.00000020.mdmp\")","Found string \"AES-CMAC\" (Indicator: \"aes\"; Source: \"00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.74841000.00000020.mdmp\")","Found string \"XTS-AES\" (Indicator: \"aes\"; Source: \"00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.74841000.00000020.mdmp\")","Found string \"onecore\\ds\\security\\cryptoapi\\ncrypt\\crypt\\routeraeskeywrap.c\" (Indicator: \"aes\"; Source: \"00000000-00007376.00000000.113264.73451000.00000020.mdmp\")","Found string \">RSA2\" (Indicator: \"rsa2\"; Source: \"00000000-00007376.00000000.113264.73451000.00000020.mdmp\")","Found string \"RSA2S\" (Indicator: \"rsa2\"; Source: \"00000000-00007376.00000000.113264.73451000.00000020.mdmp\")","Found string \"RSA2\" (Indicator: \"rsa2\"; Source: \"00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.74841000.00000020.mdmp\")","Found string \"RSA2P\" (Indicator: \"rsa2\"; Source: \"00000000-00007376.00000000.113264.73451000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"Guyanaese Dollar\" (Indicator: \"aes\"; Source: \"00000000-00007376.00000000.113264.00320000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"ECDSA\" (Indicator: \"ecdsa\"; Source: \"00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.74841000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"ECDSA_P256\" (Indicator: \"ecdsa\"; Source: \"00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.74841000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"ECDSA_P384\" (Indicator: \"ecdsa\"; Source: \"00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.74841000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"ECDSA_P521\" (Indicator: \"ecdsa\"; Source: \"00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.74841000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"AES-GMAC\" (Indicator: \"aes\"; Source: \"00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.74841000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"3DES\" (Indicator: \"3des\"; Source: \"00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.74841000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"3DES_112\" (Indicator: \"3des\"; Source: \"00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.74841000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"AES-CMAC\" (Indicator: \"aes\"; Source: \"00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.74841000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"XTS-AES\" (Indicator: \"aes\"; Source: \"00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.74841000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"onecore\\ds\\security\\cryptoapi\\ncrypt\\crypt\\routeraeskeywrap.c\" (Indicator: \"aes\"; Source: \"00000000-00007376.00000000.113264.73451000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \">RSA2\" (Indicator: \"rsa2\"; Source: \"00000000-00007376.00000000.113264.73451000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"RSA2S\" (Indicator: \"rsa2\"; Source: \"00000000-00007376.00000000.113264.73451000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"RSA2\" (Indicator: \"rsa2\"; Source: \"00000000-00007376.00000000.113264.73451000.00000020.mdmp, 00000000-00007376.00000000.113264.74841000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"RSA2P\" (Indicator: \"rsa2\"; Source: \"00000000-00007376.00000000.113264.73451000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-87","type":2,"relevance":1,"name":"Contains ability retrieve IPv4 mapping information (API string)","description":"Found reference to API \"hook_GetIpNetTable\" (Indicator: \"GetIpNetTable\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")\n Found reference to API \"GetIpNetTable\" (Indicator: \"GetIpNetTable\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74701000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","description_v2":["Found reference to API \"hook_GetIpNetTable\" (Indicator: \"GetIpNetTable\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"GetIpNetTable\" (Indicator: \"GetIpNetTable\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74701000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"hook_GetIpNetTable\" (Indicator: \"GetIpNetTable\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetIpNetTable\" (Indicator: \"GetIpNetTable\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74701000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1016","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1016","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-188","type":2,"relevance":1,"name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","description_v2":["Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1115","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1115","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-78","type":2,"relevance":1,"name":"Contains ability to capture screen (API string)","description":"$c0","description_v2":["Found reference to API \"hook_CreateCompatibleBitmap\" (Indicator: \"CreateCompatibleBitmap\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"CreateCompatibleBitmap\" (Indicator: \"CreateCompatibleBitmap\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.748A1000.00000020.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74E31000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.76E31000.00000020.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GetDesktopWindow\" (Indicator: \"GetDesktopWindow\"; Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"CreateDCW\" (Indicator: \"CreateDC\"; Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.748A1000.00000020.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74E31000.00000020.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76E31000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GetDCEx\" (Indicator: \"GetDC\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GetWindowDC\" (Indicator: \"GetWindowDC\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"CreateDCA\" (Indicator: \"CreateDC\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.748A1000.00000020.mdmp, 00000000-00007376.00000000.113264.74E31000.00000020.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"BitBlt\" (Indicator: \"BitBlt\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.748A1000.00000020.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74E31000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.76E31000.00000020.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; Source: \"00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.748A1000.00000020.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74E31000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.76E31000.00000020.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GetDIBits\" (Indicator: \"GetDIBits\"; Source: \"00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.748A1000.00000020.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74E31000.00000020.mdmp, 00000000-00007376.00000000.113264.76E31000.00000020.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GetDCDpiScaleValue\" (Indicator: \"GetDC\"; Source: \"00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.748A1000.00000020.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74E31000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GetDC: Wnd: %p, DC: %p\" (Indicator: \"GetDC\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp\")","Found reference to API \"DWM8AND16BitHook_GetDC\" (Indicator: \"GetDC\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp\")","Found reference to API \"DWM8AND16BitHook_GetDCEx\" (Indicator: \"GetDC\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp\")","Found reference to API \"GetWindowDC: Wnd: %p, DC: %p\" (Indicator: \"GetWindowDC\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp\")","Found reference to API \"DWM8AND16BitHook_GetWindowDC\" (Indicator: \"GetWindowDC\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp\")","Found reference to API \"DWM8AND16BitCOMHook_IDirectDrawSurface_GetDC\" (Indicator: \"GetDC\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp\")","Found reference to API \"DWM8AND16BitCOMHook_IDirectDrawSurface2_GetDC\" (Indicator: \"GetDC\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp\")","Found reference to API \"DWM8AND16BitCOMHook_IDirectDrawSurface3_GetDC\" (Indicator: \"GetDC\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp\")","Found reference to API \"DWM8AND16BitCOMHook_IDirectDrawSurface4_GetDC\" (Indicator: \"GetDC\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp\")","Found reference to API \"DWM8AND16BitCOMHook_IDirectDrawSurface7_GetDC\" (Indicator: \"GetDC\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp\")","Found reference to API \"Failed to BitBlt from src to dest DC.\" (Indicator: \"BitBlt\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp\")","Found reference to API \"DirectDrawSurface::GetDC\" (Indicator: \"GetDC\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp\")","Found reference to API \"DirectDrawSurface::GetDC\" (Indicator: \"GetDC\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"hook_CreateCompatibleBitmap\" (Indicator: \"CreateCompatibleBitmap\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateCompatibleBitmap\" (Indicator: \"CreateCompatibleBitmap\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.748A1000.00000020.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74E31000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.76E31000.00000020.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetDesktopWindow\" (Indicator: \"GetDesktopWindow\"; Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateDCW\" (Indicator: \"CreateDC\"; Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.748A1000.00000020.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74E31000.00000020.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76E31000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetDCEx\" (Indicator: \"GetDC\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetWindowDC\" (Indicator: \"GetWindowDC\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateDCA\" (Indicator: \"CreateDC\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.748A1000.00000020.mdmp, 00000000-00007376.00000000.113264.74E31000.00000020.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"BitBlt\" (Indicator: \"BitBlt\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.748A1000.00000020.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74E31000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.76E31000.00000020.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; Source: \"00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.748A1000.00000020.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74E31000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.76E31000.00000020.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetDIBits\" (Indicator: \"GetDIBits\"; Source: \"00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.748A1000.00000020.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74E31000.00000020.mdmp, 00000000-00007376.00000000.113264.76E31000.00000020.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetDCDpiScaleValue\" (Indicator: \"GetDC\"; Source: \"00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.748A1000.00000020.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74E31000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetDC: Wnd: %p, DC: %p\" (Indicator: \"GetDC\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"DWM8AND16BitHook_GetDC\" (Indicator: \"GetDC\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"DWM8AND16BitHook_GetDCEx\" (Indicator: \"GetDC\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetWindowDC: Wnd: %p, DC: %p\" (Indicator: \"GetWindowDC\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"DWM8AND16BitHook_GetWindowDC\" (Indicator: \"GetWindowDC\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"DWM8AND16BitCOMHook_IDirectDrawSurface_GetDC\" (Indicator: \"GetDC\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"DWM8AND16BitCOMHook_IDirectDrawSurface2_GetDC\" (Indicator: \"GetDC\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"DWM8AND16BitCOMHook_IDirectDrawSurface3_GetDC\" (Indicator: \"GetDC\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"DWM8AND16BitCOMHook_IDirectDrawSurface4_GetDC\" (Indicator: \"GetDC\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"DWM8AND16BitCOMHook_IDirectDrawSurface7_GetDC\" (Indicator: \"GetDC\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Failed to BitBlt from src to dest DC.\" (Indicator: \"BitBlt\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"DirectDrawSurface::GetDC\" (Indicator: \"GetDC\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"DirectDrawSurface::GetDC\" (Indicator: \"GetDC\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1113","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1113","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-80","type":2,"relevance":1,"name":"Contains ability to determine disk drive type (API string)","description":"$c1","description_v2":["Found reference to API \"hook_GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"hook_GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"GetDriveType\" (Indicator: \"GetDriveType\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"hook_GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"hook_GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetDriveType\" (Indicator: \"GetDriveType\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-83","type":2,"relevance":1,"name":"Contains ability to enumerate files on disk (API string)","description":"$c2","description_v2":["Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","$c3","Found reference to API \"hook_FindFirstFileA\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"hook_FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"hook_FindNextFileA\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"hook_FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"FindFirstFile failed for %ws [GLE: %x]\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"FindFirstFile failed for %ws [GLE: %d]\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"FindFirstFile Failed on [%ws] [%d]\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"$c4"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"hook_FindFirstFileA\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"hook_FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"hook_FindNextFileA\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"hook_FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindFirstFile failed for %ws [GLE: %x]\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindFirstFile failed for %ws [GLE: %d]\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindFirstFile Failed on [%ws] [%d]\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-117","type":2,"relevance":1,"name":"Contains ability to enumerate logon sessions (API string)","description":"Found reference to API \"LsaEnumerateLogonSessions\" (Indicator: \"EnumerateLogonSessions\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74741000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")\n Found reference to API \"LsaGetLogonSessionData\" (Indicator: \"GetLogonSessionData\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74741000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","description_v2":["Found reference to API \"LsaEnumerateLogonSessions\" (Indicator: \"EnumerateLogonSessions\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74741000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"LsaGetLogonSessionData\" (Indicator: \"GetLogonSessionData\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74741000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"LsaEnumerateLogonSessions\" (Indicator: \"EnumerateLogonSessions\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74741000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LsaGetLogonSessionData\" (Indicator: \"GetLogonSessionData\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74741000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1049","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1049","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-85","type":2,"relevance":1,"name":"Contains ability to enumerate process and/or its information (API string)","description":"$c5","description_v2":["$c6","$c7","$c8","Found reference to API \"GetCurrentProcessorNumber\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"Thread32Next\" (Indicator: \"Thread32Next\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"Thread32First\" (Indicator: \"Thread32First\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"CreateToolhelp32Snapshot\" (Indicator: \"CreateToolhelp32Snapshot\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","$c9","Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"hook_CreateToolhelp32Snapshot\" (Indicator: \"CreateToolhelp32Snapshot\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"hook_Process32FirstW\" (Indicator: \"Process32First\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"hook_Process32NextW\" (Indicator: \"Process32Next\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"Process32FirstW\" (Indicator: \"Process32First\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"Process32NextW\" (Indicator: \"Process32Next\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"WTSEnumerateProcessesA\" (Indicator: \"WTSEnumerateProcesses\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"WTSEnumerateProcessesW\" (Indicator: \"WTSEnumerateProcesses\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"WTSEnumerateProcessesExA\" (Indicator: \"WTSEnumerateProcesses\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"WTSEnumerateProcessesExW\" (Indicator: \"WTSEnumerateProcesses\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","$ca","Found reference to API \"NS_EmulateEnvironmentBlock::APIHook_GetEnvironmentStringsA\" (Indicator: \"GetEnvironmentStrings\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_EmulateEnvironmentBlock::APIHook_GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"GetEnvironmentStrings\" (Indicator: \"GetEnvironmentStrings\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GetEnvironmentStringsA\" (Indicator: \"GetEnvironmentStrings\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"NtQueryInformationProcess failed [%x]\" (Indicator: \"QueryInformationProcess\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"$cb"},{"type":"linebreak"},{"type":"text","value":"$cc"},{"type":"linebreak"},{"type":"text","value":"$cd"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetCurrentProcessorNumber\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Thread32Next\" (Indicator: \"Thread32Next\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Thread32First\" (Indicator: \"Thread32First\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateToolhelp32Snapshot\" (Indicator: \"CreateToolhelp32Snapshot\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"$ce"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"hook_CreateToolhelp32Snapshot\" (Indicator: \"CreateToolhelp32Snapshot\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"hook_Process32FirstW\" (Indicator: \"Process32First\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"hook_Process32NextW\" (Indicator: \"Process32Next\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Process32FirstW\" (Indicator: \"Process32First\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Process32NextW\" (Indicator: \"Process32Next\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WTSEnumerateProcessesA\" (Indicator: \"WTSEnumerateProcesses\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WTSEnumerateProcessesW\" (Indicator: \"WTSEnumerateProcesses\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WTSEnumerateProcessesExA\" (Indicator: \"WTSEnumerateProcesses\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WTSEnumerateProcessesExW\" (Indicator: \"WTSEnumerateProcesses\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"$cf"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_EmulateEnvironmentBlock::APIHook_GetEnvironmentStringsA\" (Indicator: \"GetEnvironmentStrings\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_EmulateEnvironmentBlock::APIHook_GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetEnvironmentStrings\" (Indicator: \"GetEnvironmentStrings\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetEnvironmentStringsA\" (Indicator: \"GetEnvironmentStrings\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NtQueryInformationProcess failed [%x]\" (Indicator: \"QueryInformationProcess\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-84","type":2,"relevance":1,"name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"hook_GetLogicalDriveStringsA\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")\n Found reference to API \"hook_GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")\n Found reference to API \"GetLogicalDriveStringsA\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")\n Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","description_v2":["Found reference to API \"hook_GetLogicalDriveStringsA\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"hook_GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"GetLogicalDriveStringsA\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"hook_GetLogicalDriveStringsA\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"hook_GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetLogicalDriveStringsA\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-118","type":2,"relevance":1,"name":"Contains ability to query network adapter information (API string)","description":"Found reference to API \"hook_GetAdaptersInfo\" (Indicator: \"GetAdaptersInfo\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")\n Found reference to API \"hook_GetAdaptersAddresses\" (Indicator: \"GetAdaptersAddresses\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")\n Found reference to API \"GetAdaptersInfo\" (Indicator: \"GetAdaptersInfo\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74701000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")\n Found reference to API \"GetAdaptersAddresses\" (Indicator: \"GetAdaptersAddresses\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.74701000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","description_v2":["Found reference to API \"hook_GetAdaptersInfo\" (Indicator: \"GetAdaptersInfo\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"hook_GetAdaptersAddresses\" (Indicator: \"GetAdaptersAddresses\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"GetAdaptersInfo\" (Indicator: \"GetAdaptersInfo\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74701000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GetAdaptersAddresses\" (Indicator: \"GetAdaptersAddresses\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.74701000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"hook_GetAdaptersInfo\" (Indicator: \"GetAdaptersInfo\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"hook_GetAdaptersAddresses\" (Indicator: \"GetAdaptersAddresses\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetAdaptersInfo\" (Indicator: \"GetAdaptersInfo\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74701000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetAdaptersAddresses\" (Indicator: \"GetAdaptersAddresses\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.74701000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1016","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1016","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-534","type":2,"relevance":0,"name":"Contains ability to read files (API string)","description":"$d0","description_v2":["Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"NtReadFile\" (Indicator: \"NtReadFile\"; Source: \"00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00007376.00000000.113264.00D25000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NtReadFile\" (Indicator: \"NtReadFile\"; Source: \"00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-259","type":2,"relevance":1,"name":"Contains ability to retrieve Domain Trust data (API string)","description":"Found reference to API \"DsGetDcNameW\" (Indicator: \"DsGetDcName\"; Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","description_v2":["Found reference to API \"DsGetDcNameW\" (Indicator: \"DsGetDcName\"; Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"DsGetDcNameW\" (Indicator: \"DsGetDcName\"; Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1482","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1482","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-119","type":2,"relevance":1,"name":"Contains ability to retrieve IPv4 TCP connection table (API string)","description":"Found reference to API \"hook_GetTcpTable2\" (Indicator: \"GetTcpTable\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")\n Found reference to API \"GetTcpTable2\" (Indicator: \"GetTcpTable\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74701000.00000020.mdmp\")","description_v2":["Found reference to API \"hook_GetTcpTable2\" (Indicator: \"GetTcpTable\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"GetTcpTable2\" (Indicator: \"GetTcpTable\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74701000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"hook_GetTcpTable2\" (Indicator: \"GetTcpTable\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTcpTable2\" (Indicator: \"GetTcpTable\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74701000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1049","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1049","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-452","type":2,"relevance":1,"name":"Contains ability to retrieve SID for the specified name (API string)","description":"Found reference to API \"hook_LookupAccountNameA\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")\n Found reference to API \"hook_LookupAccountNameW\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")\n Found reference to API \"LookupAccountNameA\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")\n Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","description_v2":["Found reference to API \"hook_LookupAccountNameA\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"hook_LookupAccountNameW\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"LookupAccountNameA\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"hook_LookupAccountNameA\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"hook_LookupAccountNameW\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LookupAccountNameA\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1087","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1087","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-427","type":2,"relevance":1,"name":"Contains ability to retrieve a module handle (API string)","description":"$d1","description_v2":["$d2","Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","$d3","Found reference to API \"Armadillo_GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp\")","Found reference to API \"GetModuleHandle(NULL) failed [%d]\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"$d4"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"$d5"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Armadillo_GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleHandle(NULL) failed [%d]\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-317","type":2,"relevance":1,"name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"$d6","description_v2":["$d7","Found reference to API \"LdrGetProcedureAddress\" (Indicator: \"LdrGetProcedureAddress\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778E3000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")","Found reference to API \"NS_ForceDXSetupSuccess::APIHook_GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_WRPDllRegister::APIHook_GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"SE_GetProcAddressForCaller\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")","Found reference to API \"SeHookManagerGetProcAddress failed\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp\")","Found reference to API \"SE_GetProcAddressIgnoreIncExc\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp\")","Found reference to API \"SE_GetProcAddressLoad\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp\")","Found reference to API \"SeHookManagerGetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"$d8"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LdrGetProcedureAddress\" (Indicator: \"LdrGetProcedureAddress\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778E3000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_ForceDXSetupSuccess::APIHook_GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_WRPDllRegister::APIHook_GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SE_GetProcAddressForCaller\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SeHookManagerGetProcAddress failed\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SE_GetProcAddressIgnoreIncExc\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SE_GetProcAddressLoad\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SeHookManagerGetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-207","type":2,"relevance":1,"name":"Contains ability to retrieve file and directory information (API string)","description":"$d9","description_v2":["$da","Found reference to API \"GetFileInformationByHandleEx\" (Indicator: \"GetFileInformationByHandle\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GetFileAttributesExW\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GetFileSize\" (Indicator: \"GetFileSize\"; Source: \"00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"NtQueryAttributesFile\" (Indicator: \"QueryAttributesFile\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")","Found reference to API \"NtQueryInformationFile\" (Indicator: \"QueryInformationFile\"; Source: \"00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")","Found reference to API \"ZwQueryInformationFile\" (Indicator: \"QueryInformationFile\"; Source: \"00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")","Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GetCurrentDirectoryW\" (Indicator: \"GetCurrentDirectory\"; Source: \"00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GetTempPathW\" (Indicator: \"GetTempPath\"; Source: \"00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GetTempFileNameW\" (Indicator: \"GetTempFileName\"; Source: \"00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GetFileVersionInfoW\" (Indicator: \"GetFileVersionInfo\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GetFileVersionInfoSizeW\" (Indicator: \"GetFileVersionInfo\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GetFileVersionInfoSizeW\" (Indicator: \"GetFileVersionInfoSize\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"NS_ProfilesGetFolderPath::APIHook_SHGetSpecialFolderLocation\" (Indicator: \"SHGetSpecialFolderLocation\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"SHGetSpecialFolderLocation\" (Indicator: \"SHGetSpecialFolderLocation\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"NS_SyncSystem32AndSysWow64::APIHook_GetFileVersionInfoSizeA\" (Indicator: \"GetFileVersionInfo\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_SyncSystem32AndSysWow64::APIHook_GetFileVersionInfoSizeA\" (Indicator: \"GetFileVersionInfoSize\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_SyncSystem32AndSysWow64::APIHook_GetFileVersionInfoSizeW\" (Indicator: \"GetFileVersionInfo\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_SyncSystem32AndSysWow64::APIHook_GetFileVersionInfoSizeW\" (Indicator: \"GetFileVersionInfoSize\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"GetFileVersionInfoSizeA\" (Indicator: \"GetFileVersionInfo\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GetFileVersionInfoSizeA\" (Indicator: \"GetFileVersionInfoSize\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"NS_SyncSystemAndSystem32::APIHook_GetFileVersionInfoSizeA\" (Indicator: \"GetFileVersionInfo\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_SyncSystemAndSystem32::APIHook_GetFileVersionInfoSizeA\" (Indicator: \"GetFileVersionInfoSize\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_SyncSystemAndSystem32::APIHook_GetFileVersionInfoSizeW\" (Indicator: \"GetFileVersionInfo\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_SyncSystemAndSystem32::APIHook_GetFileVersionInfoSizeW\" (Indicator: \"GetFileVersionInfoSize\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"BuildDXDiag: GetSystemDirectory Failed\" (Indicator: \"GetSystemDirectory\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"SpellIt: GetSystemDirectory Failed\" (Indicator: \"GetSystemDirectory\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"PathFindFileNameW\" (Indicator: \"PathFindFileName\"; Source: \"00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74D81000.00000020.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GetTempPathA\" (Indicator: \"GetTempPath\"; Source: \"00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GetTempFileNameA\" (Indicator: \"GetTempFileName\"; Source: \"00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"$db"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileInformationByHandleEx\" (Indicator: \"GetFileInformationByHandle\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileAttributesExW\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileSize\" (Indicator: \"GetFileSize\"; Source: \"00000000-00007376.00000000.113264.72F3F000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NtQueryAttributesFile\" (Indicator: \"QueryAttributesFile\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NtQueryInformationFile\" (Indicator: \"QueryInformationFile\"; Source: \"00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ZwQueryInformationFile\" (Indicator: \"QueryInformationFile\"; Source: \"00000000-00007376.00000000.113264.7303D000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetCurrentDirectoryW\" (Indicator: \"GetCurrentDirectory\"; Source: \"00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.745E6000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTempPathW\" (Indicator: \"GetTempPath\"; Source: \"00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.749D9000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76604000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTempFileNameW\" (Indicator: \"GetTempFileName\"; Source: \"00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileVersionInfoW\" (Indicator: \"GetFileVersionInfo\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileVersionInfoSizeW\" (Indicator: \"GetFileVersionInfo\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileVersionInfoSizeW\" (Indicator: \"GetFileVersionInfoSize\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_ProfilesGetFolderPath::APIHook_SHGetSpecialFolderLocation\" (Indicator: \"SHGetSpecialFolderLocation\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SHGetSpecialFolderLocation\" (Indicator: \"SHGetSpecialFolderLocation\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_SyncSystem32AndSysWow64::APIHook_GetFileVersionInfoSizeA\" (Indicator: \"GetFileVersionInfo\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_SyncSystem32AndSysWow64::APIHook_GetFileVersionInfoSizeA\" (Indicator: \"GetFileVersionInfoSize\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_SyncSystem32AndSysWow64::APIHook_GetFileVersionInfoSizeW\" (Indicator: \"GetFileVersionInfo\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_SyncSystem32AndSysWow64::APIHook_GetFileVersionInfoSizeW\" (Indicator: \"GetFileVersionInfoSize\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileVersionInfoSizeA\" (Indicator: \"GetFileVersionInfo\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileVersionInfoSizeA\" (Indicator: \"GetFileVersionInfoSize\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_SyncSystemAndSystem32::APIHook_GetFileVersionInfoSizeA\" (Indicator: \"GetFileVersionInfo\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_SyncSystemAndSystem32::APIHook_GetFileVersionInfoSizeA\" (Indicator: \"GetFileVersionInfoSize\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_SyncSystemAndSystem32::APIHook_GetFileVersionInfoSizeW\" (Indicator: \"GetFileVersionInfo\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_SyncSystemAndSystem32::APIHook_GetFileVersionInfoSizeW\" (Indicator: \"GetFileVersionInfoSize\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"BuildDXDiag: GetSystemDirectory Failed\" (Indicator: \"GetSystemDirectory\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SpellIt: GetSystemDirectory Failed\" (Indicator: \"GetSystemDirectory\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"PathFindFileNameW\" (Indicator: \"PathFindFileName\"; Source: \"00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74D81000.00000020.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTempPathA\" (Indicator: \"GetTempPath\"; Source: \"00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTempFileNameA\" (Indicator: \"GetTempFileName\"; Source: \"00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-478","type":2,"relevance":1,"name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","description_v2":["Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-116","type":2,"relevance":1,"name":"Contains ability to retrieve state data for the computer (API string)","description":"Found reference to API \"DsRoleGetPrimaryDomainInformation\" (Indicator: \"DsRoleGetPrimaryDomainInformation\"; Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","description_v2":["Found reference to API \"DsRoleGetPrimaryDomainInformation\" (Indicator: \"DsRoleGetPrimaryDomainInformation\"; Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"DsRoleGetPrimaryDomainInformation\" (Indicator: \"DsRoleGetPrimaryDomainInformation\"; Source: \"00000000-00007376.00000000.113264.73051000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-122","type":2,"relevance":1,"name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"$dc","description_v2":["Found reference to API \"hook_GetComputerNameExA\" (Indicator: \"GetComputerName\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"hook_GetComputerNameExW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GetComputerNameExA\" (Indicator: \"GetComputerName\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"hook_GetComputerNameExA\" (Indicator: \"GetComputerName\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"hook_GetComputerNameExW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetComputerNameExA\" (Indicator: \"GetComputerName\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74BAB000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.7707F000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-164","type":2,"relevance":1,"name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"$dd","description_v2":["$de","$df","Found reference to API \"Armadillo_GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"$e0"},{"type":"linebreak"},{"type":"text","value":"$e1"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Armadillo_GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-532","type":2,"relevance":1,"name":"Contains ability to retrieve the host name of a computer (API string)","description":"Found reference to API \"hook_gethostname\" (Indicator: \"gethostname\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")\n Found reference to API \"gethostname\" (Indicator: \"gethostname\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74BC1000.00000020.mdmp\")","description_v2":["Found reference to API \"hook_gethostname\" (Indicator: \"gethostname\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"gethostname\" (Indicator: \"gethostname\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74BC1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"hook_gethostname\" (Indicator: \"gethostname\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"gethostname\" (Indicator: \"gethostname\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74BC1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-107","type":2,"relevance":1,"name":"Contains ability to retrieve the host's architecture (API string)","description":"$e2","description_v2":["Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"NS_ProfilesEnvStrings::APIHook_GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"NS_ProfilesEnvStrings::APIHook_GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.746F3000.00000002.mdmp, 00000000-00007376.00000000.113264.74832000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.76EE7000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_ProfilesEnvStrings::APIHook_GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NS_ProfilesEnvStrings::APIHook_GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-131","type":2,"relevance":1,"name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"$e3","description_v2":["Found reference to API \"hook_GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76501000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GetSystemMetricsForDpi\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"hook_GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.74DBC000.00000002.mdmp, 00000000-00007376.00000000.113264.74F6C000.00000002.mdmp, 00000000-00007376.00000000.113264.76501000.00000020.mdmp, 00000000-00007376.00000000.113264.76941000.00000020.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.7789F000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemMetricsForDpi\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.749F1000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-205","type":2,"relevance":1,"name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"$e4","description_v2":["$e5","Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"$e6"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00007376.00000000.113264.72F13000.00000002.mdmp, 00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7309D000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.7775B000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1497.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1497/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-437","type":2,"relevance":1,"name":"Contains ability to retrieve token privileges information (API string)","description":"$e7","description_v2":["Found reference to API \"CheckTokenMembership failed: %d\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")","Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CheckTokenMembership failed: %d\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00007376.00000000.113264.730C1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.740AE000.00000002.mdmp, 00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.74A74000.00000002.mdmp, 00000000-00007376.00000000.113264.74C0C000.00000002.mdmp, 00000000-00007376.00000000.113264.76387000.00000002.mdmp, 00000000-00007376.00000000.113264.7657A000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.76E1E000.00000002.mdmp, 00000000-00007376.00000000.113264.76E4B000.00000002.mdmp, 00000000-00007376.00000000.113264.77110000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1134","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1134","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-217","type":2,"relevance":1,"name":"Contains ability to retrieve user privileges (API string)","description":"Found reference to API \"IsUserAnAdmin\" (Indicator: \"IsUserAnAdmin\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","description_v2":["Found reference to API \"IsUserAnAdmin\" (Indicator: \"IsUserAnAdmin\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"IsUserAnAdmin\" (Indicator: \"IsUserAnAdmin\"; Source: \"00000000-00007376.00000000.113264.74491000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1033","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1033","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-157","type":2,"relevance":1,"name":"Contains ability to retrieve user-agents (API string)","description":"Found reference to API \"ObtainUserAgentString\" (Indicator: \"ObtainUserAgentString\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","description_v2":["Found reference to API \"ObtainUserAgentString\" (Indicator: \"ObtainUserAgentString\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"ObtainUserAgentString\" (Indicator: \"ObtainUserAgentString\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-121","type":2,"relevance":1,"name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$e8","description_v2":["$e9","Found reference to API \"hook_LookupAccountSidA\" (Indicator: \"LookupAccountSid\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"hook_LookupAccountSidW\" (Indicator: \"LookupAccountSid\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"hook_LookupAccountNameA\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"hook_LookupAccountNameW\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"hook_GetUserNameExA\" (Indicator: \"GetUserName\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"hook_GetUserNameExW\" (Indicator: \"GetUserName\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"hook_NetWkstaGetInfo\" (Indicator: \"NetWkstaGetInfo\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")","Found reference to API \"GetUserNameA\" (Indicator: \"GetUserName\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GetUserNameW\" (Indicator: \"GetUserName\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"LookupAccountSidA\" (Indicator: \"LookupAccountSid\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"LookupAccountSidW\" (Indicator: \"LookupAccountSid\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"LookupAccountNameA\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GetUserNameExA\" (Indicator: \"GetUserName\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74741000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"GetUserNameExW\" (Indicator: \"GetUserName\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.746E1000.00000020.mdmp, 00000000-00007376.00000000.113264.74741000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.77071000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"NetWkstaGetInfo\" (Indicator: \"NetWkstaGetInfo\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"LsaLookupSids\" (Indicator: \"LsaLookupSids\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"LsaLookupSids2\" (Indicator: \"LsaLookupSids\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"WTSQueryUserToken\" (Indicator: \"WTSQueryUserToken\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"WTSQuerySessionInformationA\" (Indicator: \"WTSQuerySessionInformation\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"WTSQuerySessionInformationW\" (Indicator: \"WTSQuerySessionInformation\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"LsaEnumerateLogonSessions\" (Indicator: \"LsaEnumerateLogonSessions\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74741000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"LsaGetLogonSessionData\" (Indicator: \"LsaGetLogonSessionData\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74741000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")","Found reference to API \"NtQueryObject\" (Indicator: \"NtQueryObject\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.73336000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74624000.00000002.mdmp, 00000000-00007376.00000000.113264.747EB000.00000002.mdmp, 00000000-00007376.00000000.113264.7689B000.00000002.mdmp, 00000000-00007376.00000000.113264.77A98000.00000002.mdmp, 00000000-00007376.00000000.113264.77C61000.00000020.mdmp\")"],"description_v3":[{"type":"text","value":"$ea"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"hook_LookupAccountSidA\" (Indicator: \"LookupAccountSid\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"hook_LookupAccountSidW\" (Indicator: \"LookupAccountSid\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"hook_LookupAccountNameA\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"hook_LookupAccountNameW\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"hook_GetUserNameExA\" (Indicator: \"GetUserName\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"hook_GetUserNameExW\" (Indicator: \"GetUserName\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"hook_NetWkstaGetInfo\" (Indicator: \"NetWkstaGetInfo\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetUserNameA\" (Indicator: \"GetUserName\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetUserNameW\" (Indicator: \"GetUserName\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LookupAccountSidA\" (Indicator: \"LookupAccountSid\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LookupAccountSidW\" (Indicator: \"LookupAccountSid\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LookupAccountNameA\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetUserNameExA\" (Indicator: \"GetUserName\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.74741000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetUserNameExW\" (Indicator: \"GetUserName\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.746E1000.00000020.mdmp, 00000000-00007376.00000000.113264.74741000.00000020.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.77071000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NetWkstaGetInfo\" (Indicator: \"NetWkstaGetInfo\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LsaLookupSids\" (Indicator: \"LsaLookupSids\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-00007376.00000000.113264.7450A000.00000002.mdmp, 00000000-00007376.00000000.113264.74781000.00000020.mdmp, 00000000-00007376.00000000.113264.74B71000.00000020.mdmp, 00000000-00007376.00000000.113264.778F1000.00000020.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LsaLookupSids2\" (Indicator: \"LsaLookupSids\"; Source: \"00000000-00007376.00000000.113264.72FA4000.00000002.mdmp, 00000000-000073