24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 48:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T488,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 5ee4fc645fa8… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 5ee4fc645fa8…. Malware family: Trojan.Generic. Threat score 100/100. 18/27 AV engines flagged this file. 7 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/5ee4fc645fa88cd85eddc57b9fc28733a891d0bb84a648a560264b983b9c5488","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","5ee4fc645fa88cd85eddc57b9fc28733a891d0bb84a648a560264b983b9c5488"],"about":{"@type":"SoftwareApplication","name":"sample_02.exe","applicationCategory":["peexe","executable"],"identifier":"5ee4fc645fa88cd85eddc57b9fc28733a891d0bb84a648a560264b983b9c5488","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":18,"total":27},"behavioralIndicators":{"malicious":7,"suspicious":24},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T109d,Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "sample_02.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "sample_02.exe") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "sample_02.exe") Found reference to API "ZwAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; File: "sample_02.exe") Found reference to API "NtCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp") Found reference to API "WriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "NtWriteVirtualMemory"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp") Found reference to API "ZwAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00005560.00000001.210599.00401000.00000020.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API "LsaFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API "SamFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp")26:T914,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "sample_02.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "sample_02.exe") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "sample_02.exe") Found reference to API "NtWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp") Found reference to API "NtWaitForSingleObject" (Indicator: "NtWaitForSingleObject"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp")27:T663,Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "sample_02.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "sample_02.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "sample_02.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp")28:T4d2,"sample_02.exe" queried SystemProcessInformation at 00000000-00005560-00000C15-2267118685 [PID: 5560] "sample_02.exe" queried SystemProcessInformation at 00000000-00005560-00000C15-2267126330 [PID: 5560] "sample_02.exe" queried SystemProcessInformation at 00000000-00005560-00000C15-2267285498 [PID: 5560] "sample_02.exe" queried SystemProcessInformation at 00000000-00005560-00000C15-2267307864 [PID: 5560] "sample_02.exe" queried SystemProcessInformation at 00000000-00005560-00000C15-2267581767 [PID: 5560] "sample_02.exe" queried SystemProcessInformation at 00000000-00005560-00000C15-2267591600 [PID: 5560] "sample_02.exe" queried SystemProcessInformation at 00000000-00005560-00000C15-2284938172 [PID: 5560] "sample_02.exe" queried SystemProcessInformation at 00000000-00005560-00000C15-2284945449 [PID: 5560] "sample_02.exe" queried SystemProcessInformation at 00000000-00005560-00000C15-2285307605 [PID: 5560] "sample_02.exe" queried SystemProcessInformation at 00000000-00005560-00000C15-2285314891 [PID: 5560] "sample_02.exe" queried SystemProcessInformation at 00000000-00005560-00000C15-2290061024 [PID: 5560] "sample_02.exe" queried SystemProcessInformation at 00000000-00005560-00000C15-2290068720 [PID: 5560]29:T851,Assembly shows XOR instruction xor dword ptr [ebx+eax+00h] esp in Stream UID: 49615-389-0047819C Assembly shows XOR instruction xor dword ptr [ebx+eax+00h] ebp in Stream UID: 49615-389-0047819C Assembly shows XOR instruction xor dh byte ptr [eax+03h] in Stream UID: 49615-389-0047819C Assembly shows XOR instruction xor dword ptr [eax+03h] edi in Stream UID: 49615-389-0047819C Assembly shows XOR instruction xor al byte ptr [ebx+eax+00050000h] in Stream UID: 49615-389-0047819C Assembly shows XOR instruction xor dword ptr [eax+04000003h] ecx in Stream UID: 49615-389-0047819C Assembly shows XOR instruction xor dword ptr [bx+si+00000003h] edx in Stream UID: 49615-389-0047819C Assembly shows XOR instruction xor dl byte ptr [si+00000003h] in Stream UID: 49615-389-0047819C Assembly shows XOR instruction xor ebx dword ptr [bx+si+00000003h] in Stream UID: 49615-389-0047819C Assembly shows XOR instruction xor ebx dword ptr [ebx+eax+00020000h] in Stream UID: 49615-389-0047819C Assembly shows XOR instruction xor al A0h in Stream UID: 49615-389-0047819C Assembly shows XOR instruction xor eax 000003A4h in Stream UID: 49615-389-0047819C Assembly shows XOR instruction xor dword ptr [edx+78h] edx in Stream UID: 49615-389-0047819C Assembly shows XOR instruction xor al 89h in Stream UID: 49615-389-0047819C Assembly shows XOR instruction xor dword ptr [ebx+65h] ecx in Stream UID: 49615-389-0047819C Assembly shows XOR instruction xor dword ptr [ebx+54h] eax in Stream UID: 49615-389-0047819C Assembly shows XOR instruction xor dword ptr [ebx+edx*2+52h] eax in Stream UID: 49615-389-0047819C Assembly shows XOR instruction xor dword ptr [edx+4Ch] edx in Stream UID: 49615-389-0047819C Assembly shows XOR instruction xor al 24h in Stream UID: 49615-456-004066C8 Assembly shows XOR instruction xor eax edx in Stream UID: 49615-2204-0042578C Assembly shows XOR instruction xor byte ptr [eax+ebx] dl in Stream UID: 49615-3087-00406E68 Assembly shows XOR instruction xor al 12h in Stream UID: 49615-3398-00406F6A Assembly shows XOR instruction xor al 21h in Stream UID: 49615-3402-004068282a:T12fa,Found XOR loop in file "sample.bin" at offset 680084; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 682336; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 744691; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 753642; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 827227; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 850784; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 887908; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1252303; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1559069; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1563733; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1564173; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1567569; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1571587; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1572555; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1577835; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1580957; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1587719; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1589331; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1590155; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 181077; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 682880; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 740169; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 788349; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 790779; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 801037; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 901954; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1017040; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1018090; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1020746; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1069630; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1183586; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1244904; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1257417; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1562771; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1580457; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 122280; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 161820; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 174641; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 177012; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 516268; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 559438; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 572154; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 578237; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 752581; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 889359; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1163713; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1201522; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1203604; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1209297; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1224562; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1225599; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1234914; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1260084; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1561448; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1562260; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1563714; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1564158; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1565262; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1565510; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1572516; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1575390; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1577134; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1577796; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1586888; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1589312; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1590116; code bytes = 80302b:T527,Found reference to API "GetDiskFreeSpaceA" (Indicator: "GetDiskFreeSpace"; File: "sample_02.exe") Found reference to API "GetDiskFreeSpaceExA" (Indicator: "GetDiskFreeSpace"; File: "sample_02.exe") Found reference to API "GetDiskFreeSpaceExA" (Indicator: "GetDiskFreeSpaceEx"; File: "sample_02.exe") Found reference to API "GetDiskFreeSpaceExA" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.00401000.00000020.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API "GetDiskFreeSpaceExA" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.00401000.00000020.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API "GetDiskFreeSpaceA" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp")2c:T65f,Found system information discovery API: "GetMonitorInfoA" in file "sample_02.exe" Found system information discovery API: "GetMonitorInfo" in file "sample_02.exe" Found system information discovery API: "GetMonitorInfoW" in file "sample_02.exe" Found system information discovery API: "NtQuerySystemInformation" in "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp" Found system information discovery API: "GetMonitorInfoA" in "00000000-00005560.00000001.210599.00401000.00000020.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp" Found system information discovery API: "GetMonitorInfo" in "00000000-00005560.00000001.210599.00401000.00000020.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp" Found system information discovery API: "GetMonitorInfoW" in "00000000-00005560.00000001.210599.00401000.00000020.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp" Found system information discovery API: "GetEnvironmentStrings" in "00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp"2d:Tc5b,"sample_02.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005560) "sample_02.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005560) "sample_02.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000010f33501b4f23501226efc7400008f03000000002d6efc749a26d2f22d000000ecb7a07638f3350100003903b8e0530398b15203030000008000000078f2350100003903fcf2350170c8fd74d6a5e586feffffff2d000000d0ccaf7627000000ccf23501856afe741c2303750cf33501f85ffe7408000000bb69fd74b269fd742227d2f22d000000ecb7a07627000000d0ccaf76e0f235012d000000d0ccaf762700000010f33501856afe741c23037558f335017e8aae76ee8cae76738aae76e8ebc8b52d000000ecb7a07627000000d0ccaf7674268f0308268f03e8ebc8b520f33501fc52ec760cf43501e084ae7688e917c2feffffff738aae76 (UID: 00000000-00005560) "sample_02.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005560) "sample_02.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005560)2e:T5b4,Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "sample_02.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "sample_02.exe") Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "sample_02.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp")2f:T422,Found reference to API "EnumServicesStatusA" (Indicator: "EnumServicesStatus"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp") Found reference to API "EnumServicesStatusW" (Indicator: "EnumServicesStatus"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp") Found reference to API "EnumServicesStatusExA" (Indicator: "EnumServicesStatus"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp") Found reference to API "EnumServicesStatusExW" (Indicator: "EnumServicesStatus"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp")30:Ta46,"sample_02.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005560) "sample_02.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005560) "sample_02.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005560) "sample_02.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005560) "sample_02.exe" called "LoadLibrary" with a parameter C:\sample_02.ENU (UID: 00000000-00005560) "sample_02.exe" called "LoadLibrary" with a parameter C:\sample_02.EN (UID: 00000000-00005560) "sample_02.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00005560) "sample_02.exe" called "LoadLibrary" with a parameter URL (UID: 00000000-00005560) "sample_02.exe" called "LoadLibrary" with a parameter Amsi (UID: 00000000-00005560) "sample_02.exe" called "LoadLibrary" with a parameter bcRypt (UID: 00000000-00005560) "sample_02.exe" called "LoadLibrary" with a parameter Rpcrt4 (UID: 00000000-00005560) "sample_02.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00005560) "sample_02.exe" called "LoadLibrary" with a parameter ieproxy (UID: 00000000-00005560) "sample_02.exe" called "LoadLibrary" with a parameter wintrust (UID: 00000000-00005560) "sample_02.exe" called "LoadLibrary" with a parameter mssip32 (UID: 00000000-00005560) "sample_02.exe" called "LoadLibrary" with a parameter bcrypt (UID: 00000000-00005560) "sample_02.exe" called "LoadLibrary" with a parameter smartscreenps (UID: 00000000-00005560) "sample_02.exe" called "LoadLibrary" with a parameter 41006d00 (UID: 00000000-00005560) "sample_02.exe" called "LoadLibrary" with a parameter sppc (UID: 00000000-00005560) "sample_02.exe" called "LoadLibrary" with a parameter 416d (UID: 00000000-00005560) "sample_02.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00005560) "sample_02.exe" called "LoadLibrary" with a parameter dbgcore (UID: 00000000-00005560) "sample_02.exe" called "LoadLibrary" with a parameter tquery (UID: 00000000-00005560) "sample_02.exe" called "LoadLibrary" with a parameter spp (UID: 00000000-00005560) "sample_02.exe" called "LoadLibrary" with a parameter psapi (UID: 00000000-00005560) "sample_02.exe" called "LoadLibrary" with a parameter endpointdlp (UID: 00000000-00005560) "sample_02.exe" called "LoadLibrary" with a parameter Ntdll (UID: 00000000-00005560) "sample_02.exe" called "LoadLibrary" with a parameter Advapi (UID: 00000000-00005560) "sample_02.exe" called "LoadLibrary" with a parameter Kernel32 (UID: 00000000-00005560)31:Tac6,"sample_02.exe" called "GetProcAddress" with a parameter CheckRemoteDebuggerPresent (UID: 00000000-00005560) "sample_02.exe" called "GetProcAddress" with a parameter IsDebuggerPresent (UID: 00000000-00005560) "sample_02.exe" called "GetProcAddress" with a parameter AmsiOpenSession (UID: 00000000-00005560) "sample_02.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00005560) "sample_02.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00005560) "sample_02.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00005560) "sample_02.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00005560) "sample_02.exe" called "GetProcAddress" with a parameter NtWriteVirtualMemory (UID: 00000000-00005560) "sample_02.exe" called "GetProcAddress" with a parameter FlushInstructionCache (UID: 00000000-00005560) "sample_02.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00005560) "sample_02.exe" called "GetProcAddress" with a parameter AmsiUacInitialize (UID: 00000000-00005560) "sample_02.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00005560) "sample_02.exe" called "GetProcAddress" with a parameter AmsiScanString (UID: 00000000-00005560) "sample_02.exe" called "GetProcAddress" with a parameter AmsiUacScan (UID: 00000000-00005560) "sample_02.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00005560) "sample_02.exe" called "GetProcAddress" with a parameter GetProxyDllInfo (UID: 00000000-00005560) "sample_02.exe" called "GetProcAddress" with a parameter DllRegisterServer (UID: 00000000-00005560) "sample_02.exe" called "GetProcAddress" with a parameter TrustOpenStores (UID: 00000000-00005560) "sample_02.exe" called "GetProcAddress" with a parameter WintrustAddActionID (UID: 00000000-00005560) "sample_02.exe" called "GetProcAddress" with a parameter FindCertsByIssuer (UID: 00000000-00005560) "sample_02.exe" called "GetProcAddress" with a parameter CryptSIPGetInfo (UID: 00000000-00005560) "sample_02.exe" called "GetProcAddress" with a parameter CryptSIPVerifyIndirectData (UID: 00000000-00005560) "sample_02.exe" called "GetProcAddress" with a parameter CryptSIPGetSignedDataMsg (UID: 00000000-00005560) "sample_02.exe" called "GetProcAddress" with a parameter BCryptVerifySignature (UID: 00000000-00005560) "sample_02.exe" called "GetProcAddress" with a parameter BCryptQueryProviderRegistration (UID: 00000000-00005560) "sample_02.exe" called "GetProcAddress" with a parameter BCryptRegisterProvider (UID: 00000000-00005560) "sample_02.exe" called "GetProcAddress" with a parameter DllGetActivationFactory (UID: 00000000-00005560)32:T509,Found reference to API "CreateProcessAsUserW" (Indicator: "CreateProcess"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp") Found reference to API "CreateProcessAsUserA" (Indicator: "CreateProcess"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp") Found reference to API "CreateProcessWithLogonW" (Indicator: "CreateProcess"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp")33:T582,Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "sample_02.exe") Found reference to API "NtOpenFile" (Indicator: "NtOpenFile"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API "NtCreateFile" (Indicator: "CreateFile"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp") Found reference to API "NtCreateFile" (Indicator: "NtCreateFile"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp") Found reference to API "CreateFile(dllPath)" (Indicator: "CreateFile"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp")34:T16987,Found reference to API (Indicator: "RegQueryValueExA"; File: "sample_02.exe") Found reference to API (Indicator: "RegEnumValueA"; File: "sample_02.exe") Found reference to API (Indicator: "RegOpenKeyExA"; File: "sample_02.exe") Found reference to API (Indicator: "RegFlushKey"; File: "sample_02.exe") Found reference to API (Indicator: "RegCloseKey"; File: "sample_02.exe") Found reference to API (Indicator: "GetTextExtentPoint32A"; File: "sample_02.exe") Found reference to API (Indicator: "GetStockObject"; File: "sample_02.exe") Found reference to API (Indicator: "CreateFontIndirectA"; File: "sample_02.exe") Found reference to API (Indicator: "CreateCompatibleBitmap"; File: "sample_02.exe") Found reference to API (Indicator: "CreateCompatibleDC"; File: "sample_02.exe") Found reference to API (Indicator: "ExtTextOutA"; File: "sample_02.exe") Found reference to API (Indicator: "DeleteObject"; File: "sample_02.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "sample_02.exe") Found reference to API (Indicator: "GetObjectA"; File: "sample_02.exe") Found reference to API (Indicator: "SelectObject"; File: "sample_02.exe") Found reference to API (Indicator: "GetTextMetricsA"; File: "sample_02.exe") Found reference to API (Indicator: "CreateSolidBrush"; File: "sample_02.exe") Found reference to API (Indicator: "GetDIBits"; File: "sample_02.exe") Found reference to API (Indicator: "SetStretchBltMode"; File: "sample_02.exe") Found reference to API (Indicator: "BitBlt"; File: "sample_02.exe") Found reference to API (Indicator: "DeleteDC"; File: "sample_02.exe") Found reference to API (Indicator: "StretchBlt"; File: "sample_02.exe") Found reference to API (Indicator: "CreateEventA"; File: "sample_02.exe") Found reference to API (Indicator: "GetDateFormatA"; File: "sample_02.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "sample_02.exe") Found reference to API (Indicator: "GetDiskFreeSpaceA"; File: "sample_02.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "sample_02.exe") Found reference to API (Indicator: "GetProcAddress"; File: "sample_02.exe") Found reference to API (Indicator: "SetErrorMode"; File: "sample_02.exe") Found reference to API (Indicator: "ResetEvent"; File: "sample_02.exe") Found reference to API (Indicator: "GetVersionExA"; File: "sample_02.exe") Found reference to API (Indicator: "LoadResource"; File: "sample_02.exe") Found reference to API (Indicator: "RtlUnwind"; File: "sample_02.exe") Found reference to API (Indicator: "WriteFile"; File: "sample_02.exe") Found reference to API (Indicator: "FindClose"; File: "sample_02.exe") Found reference to API (Indicator: "EnumCalendarInfoA"; File: "sample_02.exe") Found reference to API (Indicator: "GetStartupInfoA"; File: "sample_02.exe") Found reference to API (Indicator: "lstrcpynA"; File: "sample_02.exe") Found reference to API (Indicator: "lstrcpyA"; File: "sample_02.exe") Found reference to API (Indicator: "InterlockedDecrement"; File: "sample_02.exe") Found reference to API (Indicator: "lstrlenA"; File: "sample_02.exe") Found reference to API (Indicator: "SetFilePointer"; File: "sample_02.exe") Found reference to API (Indicator: "GetModuleHandleA"; File: "sample_02.exe") Found reference to API (Indicator: "GetLocaleInfoA"; File: "sample_02.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "sample_02.exe") Found reference to API (Indicator: "ExitProcess"; File: "sample_02.exe") Found reference to API (Indicator: "GetStdHandle"; File: "sample_02.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "sample_02.exe") Found reference to API (Indicator: "LoadLibraryExA"; File: "sample_02.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "sample_02.exe") Found reference to API (Indicator: "InterlockedExchange"; File: "sample_02.exe") Found reference to API (Indicator: "TlsGetValue"; File: "sample_02.exe") Found reference to API (Indicator: "CompareStringA"; File: "sample_02.exe") Found reference to API (Indicator: "FindResourceA"; File: "sample_02.exe") Found reference to API (Indicator: "GetCPInfo"; File: "sample_02.exe") Found reference to API (Indicator: "GlobalFindAtomA"; File: "sample_02.exe") Found reference to API (Indicator: "GetLastError"; File: "sample_02.exe") Found reference to API (Indicator: "GetTickCount"; File: "sample_02.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "sample_02.exe") Found reference to API (Indicator: "CreateThread"; File: "sample_02.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "sample_02.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "sample_02.exe") Found reference to API (Indicator: "GetLocalTime"; File: "sample_02.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "sample_02.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "sample_02.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "sample_02.exe") Found reference to API (Indicator: "GetVersion"; File: "sample_02.exe") Found reference to API (Indicator: "MulDiv"; File: "sample_02.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "sample_02.exe") Found reference to API (Indicator: "VirtualQuery"; File: "sample_02.exe") Found reference to API (Indicator: "VirtualFree"; File: "sample_02.exe") Found reference to API (Indicator: "SetEvent"; File: "sample_02.exe") Found reference to API (Indicator: "GetACP"; File: "sample_02.exe") Found reference to API (Indicator: "GlobalAddAtomA"; File: "sample_02.exe") Found reference to API (Indicator: "GetCommandLineA"; File: "sample_02.exe") Found reference to API (Indicator: "FreeLibrary"; File: "sample_02.exe") Found reference to API (Indicator: "SetEndOfFile"; File: "sample_02.exe") Found reference to API (Indicator: "InitializeCriticalSection"; File: "sample_02.exe") Found reference to API (Indicator: "InterlockedIncrement"; File: "sample_02.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "sample_02.exe") Found reference to API (Indicator: "FormatMessageA"; File: "sample_02.exe") Found reference to API (Indicator: "FreeResource"; File: "sample_02.exe") Found reference to API (Indicator: "GetFullPathNameA"; File: "sample_02.exe") Found reference to API (Indicator: "CloseHandle"; File: "sample_02.exe") Found reference to API (Indicator: "ReadFile"; File: "sample_02.exe") Found reference to API (Indicator: "RaiseException"; File: "sample_02.exe") Found reference to API (Indicator: "SetThreadLocale"; File: "sample_02.exe") Found reference to API (Indicator: "SizeofResource"; File: "sample_02.exe") Found reference to API (Indicator: "GlobalDeleteAtom"; File: "sample_02.exe") Found reference to API (Indicator: "CreateFileA"; File: "sample_02.exe") Found reference to API (Indicator: "TlsSetValue"; File: "sample_02.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "sample_02.exe") Found reference to API (Indicator: "LockResource"; File: "sample_02.exe") Found reference to API (Indicator: "Sleep"; File: "sample_02.exe") Found reference to API (Indicator: "LocalAlloc"; File: "sample_02.exe") Found reference to API (Indicator: "GetThreadLocale"; File: "sample_02.exe") Found reference to API (Indicator: "FindFirstFileA"; File: "sample_02.exe") Found reference to API (Indicator: "SafeArrayGetLBound"; File: "sample_02.exe") Found reference to API (Indicator: "SysAllocStringLen"; File: "sample_02.exe") Found reference to API (Indicator: "VariantCopy"; File: "sample_02.exe") Found reference to API (Indicator: "SafeArrayCreate"; File: "sample_02.exe") Found reference to API (Indicator: "VariantInit"; File: "sample_02.exe") Found reference to API (Indicator: "VariantClear"; File: "sample_02.exe") Found reference to API (Indicator: "SysReAllocStringLen"; File: "sample_02.exe") Found reference to API (Indicator: "SysFreeString"; File: "sample_02.exe") Found reference to API (Indicator: "SafeArrayPtrOfIndex"; File: "sample_02.exe") Found reference to API (Indicator: "SafeArrayGetUBound"; File: "sample_02.exe") Found reference to API (Indicator: "VariantChangeType"; File: "sample_02.exe") Found reference to API (Indicator: "CharLowerBuffA"; File: "sample_02.exe") Found reference to API (Indicator: "GetScrollInfo"; File: "sample_02.exe") Found reference to API (Indicator: "LoadCursorA"; File: "sample_02.exe") Found reference to API (Indicator: "RegisterWindowMessageA"; File: "sample_02.exe") Found reference to API (Indicator: "SendMessageA"; File: "sample_02.exe") Found reference to API (Indicator: "DestroyWindow"; File: "sample_02.exe") Found reference to API (Indicator: "InsertMenuA"; File: "sample_02.exe") Found reference to API (Indicator: "GetKeyboardLayoutList"; File: "sample_02.exe") Found reference to API (Indicator: "GetMenuStringA"; File: "sample_02.exe") Found reference to API (Indicator: "SetMenu"; File: "sample_02.exe") Found reference to API (Indicator: "AdjustWindowRectEx"; File: "sample_02.exe") Found reference to API (Indicator: "CharToOemA"; File: "sample_02.exe") Found reference to API (Indicator: "EnumWindows"; File: "sample_02.exe") Found reference to API (Indicator: "FindWindowA"; File: "sample_02.exe") Found reference to API (Indicator: "GetKeyboardLayoutNameA"; File: "sample_02.exe") Found reference to API (Indicator: "GetForegroundWindow"; File: "sample_02.exe") Found reference to API (Indicator: "IsZoomed"; File: "sample_02.exe") Found reference to API (Indicator: "OemToCharA"; File: "sample_02.exe") Found reference to API (Indicator: "GetKeyboardType"; File: "sample_02.exe") Found reference to API (Indicator: "DestroyCursor"; File: "sample_02.exe") Found reference to API (Indicator: "BeginPaint"; File: "sample_02.exe") Found reference to API (Indicator: "GetKeyboardLayout"; File: "sample_02.exe") Found reference to API (Indicator: "GetMenuItemCount"; File: "sample_02.exe") Found reference to API (Indicator: "IsWindowVisible"; File: "sample_02.exe") Found reference to API (Indicator: "DefMDIChildProcA"; File: "sample_02.exe") Found reference to API (Indicator: "CreateIcon"; File: "sample_02.exe") Found reference to API (Indicator: "GetDCEx"; File: "sample_02.exe") Found reference to API (Indicator: "GetMenuItemID"; File: "sample_02.exe") Found reference to API (Indicator: "GetLastActivePopup"; File: "sample_02.exe") Found reference to API (Indicator: "GetKeyboardState"; File: "sample_02.exe") Found reference to API (Indicator: "DispatchMessageA"; File: "sample_02.exe") Found reference to API (Indicator: "MapVirtualKeyA"; File: "sample_02.exe") Found reference to API (Indicator: "GetSystemMenu"; File: "sample_02.exe") Found reference to API (Indicator: "IsIconic"; File: "sample_02.exe") Found reference to API (Indicator: "CheckMenuItem"; File: "sample_02.exe") Found reference to API (Indicator: "GetMenuItemInfoA"; File: "sample_02.exe") Found reference to API (Indicator: "SetWindowLongA"; File: "sample_02.exe") Found reference to API (Indicator: "UnregisterClassA"; File: "sample_02.exe") Found reference to API (Indicator: "DeleteMenu"; File: "sample_02.exe") Found reference to API (Indicator: "UpdateWindow"; File: "sample_02.exe") Found reference to API (Indicator: "GetSysColor"; File: "sample_02.exe") Found reference to API (Indicator: "MapWindowPoints"; File: "sample_02.exe") Found reference to API (Indicator: "EqualRect"; File: "sample_02.exe") Found reference to API (Indicator: "CharNextA"; File: "sample_02.exe") Found reference to API (Indicator: "WindowFromPoint"; File: "sample_02.exe") Found reference to API (Indicator: "RegisterClipboardFormatA"; File: "sample_02.exe") Found reference to API (Indicator: "OffsetRect"; File: "sample_02.exe") Found reference to API (Indicator: "GetKeyState"; File: "sample_02.exe") Found reference to API (Indicator: "GetWindowRect"; File: "sample_02.exe") Found reference to API (Indicator: "SetActiveWindow"; File: "sample_02.exe") Found reference to API (Indicator: "SetMenuItemInfoA"; File: "sample_02.exe") Found reference to API (Indicator: "GetCursorPos"; File: "sample_02.exe") Found reference to API (Indicator: "IsRectEmpty"; File: "sample_02.exe") Found reference to API (Indicator: "RemovePropA"; File: "sample_02.exe") Found reference to API (Indicator: "SetForegroundWindow"; File: "sample_02.exe") Found reference to API (Indicator: "DestroyMenu"; File: "sample_02.exe") Found reference to API (Indicator: "EnumThreadWindows"; File: "sample_02.exe") Found reference to API (Indicator: "FillRect"; File: "sample_02.exe") Found reference to API (Indicator: "GetActiveWindow"; File: "sample_02.exe") Found reference to API (Indicator: "GetClipboardData"; File: "sample_02.exe") Found reference to API (Indicator: "SetFocus"; File: "sample_02.exe") Found reference to API (Indicator: "LoadBitmapA"; File: "sample_02.exe") Found reference to API (Indicator: "TranslateMDISysAccel"; File: "sample_02.exe") Found reference to API (Indicator: "InvalidateRect"; File: "sample_02.exe") Found reference to API (Indicator: "DefFrameProcA"; File: "sample_02.exe") Found reference to API (Indicator: "IsWindow"; File: "sample_02.exe") Found reference to API (Indicator: "GetIconInfo"; File: "sample_02.exe") Found reference to API (Indicator: "GetDC"; File: "sample_02.exe") Found reference to API (Indicator: "ShowScrollBar"; File: "sample_02.exe") Found reference to API (Indicator: "IsWindowEnabled"; File: "sample_02.exe") Found reference to API (Indicator: "GetMenu"; File: "sample_02.exe") Found reference to API (Indicator: "ScreenToClient"; File: "sample_02.exe") Found reference to API (Indicator: "GetClientRect"; File: "sample_02.exe") Found reference to API (Indicator: "RemoveMenu"; File: "sample_02.exe") Found reference to API (Indicator: "LoadStringA"; File: "sample_02.exe") Found reference to API (Indicator: "DrawEdge"; File: "sample_02.exe") Found reference to API (Indicator: "GetClassInfoA"; File: "sample_02.exe") Found reference to API (Indicator: "GetTopWindow"; File: "sample_02.exe") Found reference to API (Indicator: "SetRect"; File: "sample_02.exe") Found reference to API (Indicator: "ShowOwnedPopups"; File: "sample_02.exe") Found reference to API (Indicator: "SetScrollInfo"; File: "sample_02.exe") Found reference to API (Indicator: "DrawIconEx"; File: "sample_02.exe") Found reference to API (Indicator: "RegisterClassA"; File: "sample_02.exe") Found reference to API (Indicator: "FrameRect"; File: "sample_02.exe") Found reference to API (Indicator: "DrawMenuBar"; File: "sample_02.exe") Found reference to API (Indicator: "TranslateMessage"; File: "sample_02.exe") Found reference to API (Indicator: "CreateMenu"; File: "sample_02.exe") Found reference to API (Indicator: "DrawTextA"; File: "sample_02.exe") Found reference to API (Indicator: "IntersectRect"; File: "sample_02.exe") Found reference to API (Indicator: "CharLowerA"; File: "sample_02.exe") Found reference to API (Indicator: "GetWindowDC"; File: "sample_02.exe") Found reference to API (Indicator: "WaitMessage"; File: "sample_02.exe") Found reference to API (Indicator: "InsertMenuItemA"; File: "sample_02.exe") Found reference to API (Indicator: "GetDesktopWindow"; File: "sample_02.exe") Found reference to API (Indicator: "EnumChildWindows"; File: "sample_02.exe") Found reference to API (Indicator: "GetScrollPos"; File: "sample_02.exe") Found reference to API (Indicator: "InflateRect"; File: "sample_02.exe") Found reference to API (Indicator: "IsChild"; File: "sample_02.exe") Found reference to API (Indicator: "GetSysColorBrush"; File: "sample_02.exe") Found reference to API (Indicator: "SetScrollPos"; File: "sample_02.exe") Found reference to API (Indicator: "GetCursor"; File: "sample_02.exe") Found reference to API (Indicator: "SetScrollRange"; File: "sample_02.exe") Found reference to API (Indicator: "SetWindowTextA"; File: "sample_02.exe") Found reference to API (Indicator: "KillTimer"; File: "sample_02.exe") Found reference to API (Indicator: "GetScrollRange"; File: "sample_02.exe") Found reference to API (Indicator: "DrawFocusRect"; File: "sample_02.exe") Found reference to API (Indicator: "SetPropA"; File: "sample_02.exe") Found reference to API (Indicator: "EnableMenuItem"; File: "sample_02.exe") Found reference to API (Indicator: "SystemParametersInfoA"; File: "sample_02.exe") Found reference to API (Indicator: "DrawIcon"; File: "sample_02.exe") Found reference to API (Indicator: "GetPropA"; File: "sample_02.exe") Found reference to API (Indicator: "SetCapture"; File: "sample_02.exe") Found reference to API (Indicator: "DestroyIcon"; File: "sample_02.exe") Found reference to API (Indicator: "SetClassLongA"; File: "sample_02.exe") Found reference to API (Indicator: "CreateWindowExA"; File: "sample_02.exe") Found reference to API (Indicator: "LoadKeyboardLayoutA"; File: "sample_02.exe") Found reference to API (Indicator: "DefWindowProcA"; File: "sample_02.exe") Found reference to API (Indicator: "DispatchMessageW"; File: "sample_02.exe") Found reference to API (Indicator: "EnableScrollBar"; File: "sample_02.exe") Found reference to API (Indicator: "SetParent"; File: "sample_02.exe") Found reference to API (Indicator: "GetWindowPlacement"; File: "sample_02.exe") Found reference to API (Indicator: "SetWindowsHookExA"; File: "sample_02.exe") Found reference to API (Indicator: "CreatePopupMenu"; File: "sample_02.exe") Found reference to API (Indicator: "MessageBoxA"; File: "sample_02.exe") Found reference to API (Indicator: "ScrollWindow"; File: "sample_02.exe") Found reference to API (Indicator: "GetWindowLongA"; File: "sample_02.exe") Found reference to API (Indicator: "ReleaseCapture"; File: "sample_02.exe") Found reference to API (Indicator: "ReleaseDC"; File: "sample_02.exe") Found reference to API (Indicator: "GetFocus"; File: "sample_02.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "sample_02.exe") Found reference to API (Indicator: "PeekMessageW"; File: "sample_02.exe") Found reference to API (Indicator: "PeekMessageA"; File: "sample_02.exe") Found reference to API (Indicator: "GetSubMenu"; File: "sample_02.exe") Found reference to API (Indicator: "CallNextHookEx"; File: "sample_02.exe") Found reference to API (Indicator: "CallWindowProcA"; File: "sample_02.exe") Found reference to API (Indicator: "GetMenuState"; File: "sample_02.exe") Found reference to API (Indicator: "LoadIconA"; File: "sample_02.exe") Found reference to API (Indicator: "TrackPopupMenu"; File: "sample_02.exe") Found reference to API (Indicator: "EnableWindow"; File: "sample_02.exe") Found reference to API (Indicator: "GetKeyNameTextA"; File: "sample_02.exe") Found reference to API (Indicator: "IsDialogMessageA"; File: "sample_02.exe") Found reference to API (Indicator: "PtInRect"; File: "sample_02.exe") Found reference to API (Indicator: "SetWindowPos"; File: "sample_02.exe") Found reference to API (Indicator: "DrawFrameControl"; File: "sample_02.exe") Found reference to API (Indicator: "SetWindowPlacement"; File: "sample_02.exe") Found reference to API (Indicator: "SetTimer"; File: "sample_02.exe") Found reference to API (Indicator: "GetParent"; File: "sample_02.exe") Found reference to API (Indicator: "GetCapture"; File: "sample_02.exe") Found reference to API (Indicator: "ActivateKeyboardLayout"; File: "sample_02.exe") Found reference to API (Indicator: "ClientToScreen"; File: "sample_02.exe") Found reference to API (Indicator: "PostMessageA"; File: "sample_02.exe") Found reference to API (Indicator: "GetWindow"; File: "sample_02.exe") Found reference to API (Indicator: "UnhookWindowsHookEx"; File: "sample_02.exe") Found reference to API (Indicator: "PostQuitMessage"; File: "sample_02.exe") Found reference to API (Indicator: "SetCursor"; File: "sample_02.exe") Found reference to API (Indicator: "GetWindowThreadProcessId"; File: "sample_02.exe") Found reference to API (Indicator: "ShowWindow"; File: "sample_02.exe") Found reference to API (Indicator: "GetWindowTextA"; File: "sample_02.exe") Found reference to API (Indicator: "RedrawWindow"; File: "sample_02.exe") Found reference to API (Indicator: "VerQueryValueA"; File: "sample_02.exe") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; File: "sample_02.exe") Found reference to API (Indicator: "GetFileVersionInfoA"; File: "sample_02.exe") Found reference to API (Indicator: "GetLongPathNameA"; File: "sample_02.exe") Found reference to API (Indicator: "GetDiskFreeSpaceExA"; File: "sample_02.exe") Found reference to API (Indicator: "AnimateWindow"; File: "sample_02.exe") Found reference to API (Indicator: "ZwAllocateVirtualMemory"; File: "sample_02.exe") Found reference to API (Indicator: "PurgeComm"; File: "sample_02.exe") Found reference to API (Indicator: "SetCommState"; File: "sample_02.exe") Found reference to API (Indicator: "SetCommTimeouts"; File: "sample_02.exe") Found reference to API (Indicator: "SetupComm"; File: "sample_02.exe") Found reference to API (Indicator: "ClearCommError"; File: "sample_02.exe") Found reference to API (Indicator: "GetCommModemStatus"; File: "sample_02.exe") Found reference to API (Indicator: "EscapeCommFunction"; File: "sample_02.exe") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00005560.00000000.209109.03520000.00000004.mdmp") Found reference to API (Indicator: "GetLongPathNameA"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.00401000.00000020.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceExA"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.00401000.00000020.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "FlushInstructionCache"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp") Found reference to API (Indicator: "WinExec"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp") Found reference to API (Indicator: "NtQueueApcThread"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp") Found reference to API (Indicator: "CreateProcessAsUserW"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp") Found reference to API (Indicator: "NtReadVirtualMemory"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp") Found reference to API (Indicator: "NtSetSecurityObject"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp") Found reference to API (Indicator: "NtOpenProcess"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp") Found reference to API (Indicator: "Heap32ListFirst"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp") Found reference to API (Indicator: "Heap32ListNext"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp") Found reference to API (Indicator: "Heap32First"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp") Found reference to API (Indicator: "Heap32Next"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp") Found reference to API (Indicator: "Toolhelp32ReadProcessMemory"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp") Found reference to API (Indicator: "Process32First"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp") Found reference to API (Indicator: "Process32Next"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp") Found reference to API (Indicator: "Process32FirstW"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp") Found reference to API (Indicator: "Process32NextW"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp") Found reference to API (Indicator: "Thread32First"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp") Found reference to API (Indicator: "Thread32Next"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp") Found reference to API (Indicator: "Module32First"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp") Found reference to API (Indicator: "Module32Next"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp") Found reference to API (Indicator: "Module32FirstW"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp") Found reference to API (Indicator: "Module32NextW"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "NtCreateThreadEx"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp") Found reference to API (Indicator: "CheckRemoteDebuggerPresent"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp") Found reference to API (Indicator: "GetProcessMemoryInfo"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp") Found reference to API (Indicator: "RtlAllocateHeap"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp") Found reference to API (Indicator: "NtWaitForSingleObject"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp") Found reference to API (Indicator: "RtlCreateQueryDebugBuffer"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp") Found reference to API (Indicator: "NtQuerySystemInformation"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "NtDeviceIoControlFile"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp") Found reference to API (Indicator: "NtQueryDirectoryFile"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp") Found reference to API (Indicator: "RtlQueryProcessDebugInformation"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp") Found reference to API (Indicator: "EnumServicesStatusW"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp") Found reference to API (Indicator: "EnumServicesStatusExW"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp") Found reference to API (Indicator: "EnumProcessModules"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp") Found reference to API (Indicator: "CreateProcessAsUserA"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp") Found reference to API (Indicator: "CreateProcessWithLogonW"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "VirtualAllocEx"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "NtQueryVirtualMemory"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp") Found reference to API (Indicator: "NtOpenSection"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp") Found reference to API (Indicator: "NtCreateSection"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp") Found reference to API (Indicator: "NtMapViewOfSection"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp") Found reference to API (Indicator: "NtQuerySecurityObject"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp") Found reference to API (Indicator: "LdrLoadDll"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp") Found reference to API (Indicator: "LdrGetProcedureAddress"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp") Found reference to API (Indicator: "NtWriteVirtualMemory"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp") Found reference to API (Indicator: "NtOpenFile"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp") Found reference to API (Indicator: "SysFreeString"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "SysReAllocStringLen"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "SysAllocStringLen"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "GetKeyboardType"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "InterlockedDecrement"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "InterlockedIncrement"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "lstrcpynA"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "GetThreadLocale"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "GetStartupInfoA"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "GetLocaleInfoA"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.00401000.00000020.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "GetMessageA"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "CharToOemA"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "WriteProcessMemory"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "SetThreadContext"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "MoveFileA"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "IsBadWritePtr"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "IsBadReadPtr"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "GetThreadContext"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "GetFullPathNameA"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "GetDateFormatA"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "EnumCalendarInfoA"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "SafeArrayPtrOfIndex"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "SafeArrayGetUBound"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "SafeArrayGetLBound"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "SafeArrayCreate"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "VariantChangeType"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "VariantCopy"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "VariantClear"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "VariantInit"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "timeSetEvent"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp") Found reference to API (Indicator: "NtResumeThread"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp") Found reference to API (Indicator: "NtQueryInformationFile"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp") Found reference to API (Indicator: "NtClose"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "NtWriteFile"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp") Found reference to API (Indicator: "NtReadFile"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp") Found reference to API (Indicator: "NtCreateFile"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp") Found reference to API (Indicator: "NtUnmapViewOfSection"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp") Found reference to API (Indicator: "RtlDosPathNameToNtPathName_U"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp") Found reference to API (Indicator: "NtDeleteFile"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp") Found reference to API (Indicator: "RtlInitUnicodeString"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "AnimateWindow"; Source: "00000000-00005560.00000001.210599.00401000.00000020.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "ZwAllocateVirtualMemory"; Source: "00000000-00005560.00000001.210599.00401000.00000020.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "PurgeComm"; Source: "00000000-00005560.00000001.210599.00401000.00000020.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "SetCommState"; Source: "00000000-00005560.00000001.210599.00401000.00000020.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "SetCommTimeouts"; Source: "00000000-00005560.00000001.210599.00401000.00000020.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "SetupComm"; Source: "00000000-00005560.00000001.210599.00401000.00000020.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "ClearCommError"; Source: "00000000-00005560.00000001.210599.00401000.00000020.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "GetCommModemStatus"; Source: "00000000-00005560.00000001.210599.00401000.00000020.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "EscapeCommFunction"; Source: "00000000-00005560.00000001.210599.00401000.00000020.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsA"; Source: "00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentStrings"; Source: "00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "SetHandleCount"; Source: "00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "IsBadCodePtr"; Source: "00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "GetStringTypeA"; Source: "00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "LCMapStringA"; Source: "00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "LsaQueryInformationPolicy"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "RtlGetNtProductType"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "LsaLookupSids"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "NetUserGetInfo"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "SamQueryInformationUser"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "SamOpenUser"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "ConvertSidToStringSid"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "RegOpenKeyEx"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "RegCreateKeyEx"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "RegQueryInfoKey"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "RegEnumValue"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "RegDeleteValue"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "RegDeleteKey"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "PrivilegeCheck"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "CreateWellKnownSid"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "NtOpenProcessToken"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "NtQueryInformationToken"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "NtOpenThreadToken"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "RegSetValueEx"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "MakeAbsoluteSD"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "OpenThreadToken"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptorW"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "ConvertSidToStringSidW"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "GetLengthSid"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "CopySid"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "NetApiBufferFree"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "I_RpcExceptionFilter"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "I_RpcMapWin32Status"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "RpcBindingFree"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "RegEnumValueW"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "RegDeleteTreeW"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "RpcStringBindingComposeW"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "RpcBindingFromStringBindingW"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "RpcStringFreeW"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "NdrClientCall3"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "LsaOpenPolicy"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "SamConnect"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "SamOpenDomain"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "SamCloseHandle"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "LsaFreeMemory"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "LsaClose"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "SamFreeMemory"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "RtlInitializeSid"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "RtlSubAuthoritySid"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "RtlLengthSid"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "RtlCopySid"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "RtlAcquireResourceExclusive"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "RtlReleaseResource"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "RtlInitializeResource"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "RtlDeleteResource"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "RtlSubAuthorityCountSid"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "RtlEqualSid"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "RpcBindingCreateW"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "RpcBindingBind"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "SystemParametersInfoW"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "GetSystemWindowsDirectoryW"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleExA"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API (Indicator: "DelayLoadFailureHook"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp")35:T879,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "sample_02.exe") Found reference to API "NtCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp") Found reference to API "SxTracerGetThreadContextDebug" (Indicator: "GetThreadContext"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp") Found reference to API "NtAlertResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp") Found reference to API "NtResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp")36:T47b,Found reference to API "NtOpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp")37:Td2a,"SOFTWARE\Borland\Delphi\RTL" in Source: sample_02.exe "Software\Borland\Locales" in Source: sample_02.exe "Software\Borland\Delphi\Locales" in Source: sample_02.exe "SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes" in Source: sample_02.exe "\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\" in Source: sample_02.exe "System\CurrentControlSet\Control\Keyboard Layouts\%.8x" in Source: sample_02.exe "C:\\Users\\Public\\alpha /c C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d" in Source: 00000000-00005560.00000000.209109.05470000.00000004.mdmp 00000000-00005560.00000001.210599.03520000.00000004.mdmp 00000000-00005560.00000001.210599.05470000.00000004.mdmp 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00005560.00000000.209109.05470000.00000004.mdmp 00000000-00005560.00000001.210599.00401000.00000020.mdmp 00000000-00005560.00000001.210599.05470000.00000004.mdmp 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp "Software\Borland\Locales" in Source: 00000000-00005560.00000000.209109.05470000.00000004.mdmp 00000000-00005560.00000001.210599.00401000.00000020.mdmp 00000000-00005560.00000001.210599.05470000.00000004.mdmp 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00005560.00000000.209109.05470000.00000004.mdmp 00000000-00005560.00000001.210599.00401000.00000020.mdmp 00000000-00005560.00000001.210599.05470000.00000004.mdmp 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes" in Source: 00000000-00005560.00000001.210599.00401000.00000020.mdmp 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp "\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\" in Source: 00000000-00005560.00000001.210599.00401000.00000020.mdmp 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp "System\CurrentControlSet\Control\Keyboard Layouts\%.8x" in Source: 00000000-00005560.00000001.210599.00401000.00000020.mdmp 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\EasTest" in Source: 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp "Software\Policies\Microsoft\Windows\System" in Source: 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\EAS\Policies" in Source: 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp "SOFTWARE\Microsoft\DeviceEncryption" in Source: 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\EAS" in Source: 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp "RegOpenKeyEx(SYSTEM\CurrentControlSet\Control\EAS)" in Source: 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp38:T113a,"SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00005560.00000000.209109.05470000.00000004.mdmp "Software\Borland\Locales" in Source: 00000000-00005560.00000000.209109.05470000.00000004.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00005560.00000000.209109.05470000.00000004.mdmp "C:\\Users\\Public\\alpha /c C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d" in Source: 00000000-00005560.00000000.209109.05470000.00000004.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00005560.00000001.210599.00401000.00000020.mdmp "Software\Borland\Locales" in Source: 00000000-00005560.00000001.210599.00401000.00000020.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00005560.00000001.210599.00401000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes" in Source: 00000000-00005560.00000001.210599.00401000.00000020.mdmp "\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\" in Source: 00000000-00005560.00000001.210599.00401000.00000020.mdmp "System\CurrentControlSet\Control\Keyboard Layouts\%.8x" in Source: 00000000-00005560.00000001.210599.00401000.00000020.mdmp "C:\\Users\\Public\\alpha /c C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d" in Source: 00000000-00005560.00000001.210599.03520000.00000004.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00005560.00000001.210599.05470000.00000004.mdmp "Software\Borland\Locales" in Source: 00000000-00005560.00000001.210599.05470000.00000004.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00005560.00000001.210599.05470000.00000004.mdmp "C:\\Users\\Public\\alpha /c C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d" in Source: 00000000-00005560.00000001.210599.05470000.00000004.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp "Software\Borland\Locales" in Source: 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp "C:\\Users\\Public\\alpha /c C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d" in Source: 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\EasTest" in Source: 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp "Software\Policies\Microsoft\Windows\System" in Source: 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\EAS\Policies" in Source: 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp "SOFTWARE\Microsoft\DeviceEncryption" in Source: 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\EAS" in Source: 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp "RegOpenKeyEx(SYSTEM\CurrentControlSet\Control\EAS)" in Source: 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\EasTest" in Source: 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp "Software\Policies\Microsoft\Windows\System" in Source: 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\EAS\Policies" in Source: 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp "SOFTWARE\Microsoft\DeviceEncryption" in Source: 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\EAS" in Source: 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp "RegOpenKeyEx(SYSTEM\CurrentControlSet\Control\EAS)" in Source: 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp "Software\Borland\Locales" in Source: 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes" in Source: 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp "\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\" in Source: 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp "System\CurrentControlSet\Control\Keyboard Layouts\%.8x" in Source: 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp39:Ta25,"sample_02.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74c40000 "sample_02.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74c40000 "sample_02.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74c40000 "sample_02.exe" loaded module "KERNEL32" at base 77d50000 "sample_02.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 742f0000 "sample_02.exe" loaded module "KERNEL32.DLL" at base 77d50000 "sample_02.exe" loaded module "COMCTL32.DLL" at base 73890000 "sample_02.exe" loaded module "URL" at base 73700000 "sample_02.exe" loaded module "AMSI" at base 72b40000 "sample_02.exe" loaded module "BCRYPT" at base 73bc0000 "sample_02.exe" loaded module "RPCRT4" at base 750c0000 "sample_02.exe" loaded module "OLEAUT32.DLL" at base 748f0000 "sample_02.exe" loaded module "ADVAPI32.DLL" at base 75480000 "sample_02.exe" loaded module "USER32.DLL" at base 76860000 "sample_02.exe" loaded module "WINMM.DLL" at base 72ae0000 "sample_02.exe" loaded module "%WINDIR%\SYSTEM32\NTDLL.DLL" at base 77e20000 "sample_02.exe" loaded module "NTDLL" at base 77e20000 "sample_02.exe" loaded module "RPCRT4.DLL" at base 750c0000 "sample_02.exe" loaded module "SSPICLI.DLL" at base 74840000 "sample_02.exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base 727c0000 "sample_02.exe" loaded module "WINHTTP.DLL" at base 72710000 "sample_02.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 727c0000 "sample_02.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73af0000 "sample_02.exe" loaded module "IEPROXY" at base 726a0000 "sample_02.exe" loaded module "WINTRUST" at base 76670000 "sample_02.exe" loaded module "MSSIP32" at base 72690000 "sample_02.exe" loaded module "SMARTSCREENPS" at base 72660000 "sample_02.exe" loaded module "AM" at base 0 "sample_02.exe" loaded module "NTDLL.DLL" at base 77e20000 "sample_02.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74790000 "sample_02.exe" loaded module "SPPC" at base 72640000 "sample_02.exe" loaded module "换祲瑰" at base 0 "sample_02.exe" loaded module "瑮汤L" at base 0 "sample_02.exe" loaded module "流" at base 0 "sample_02.exe" loaded module "摡慶楰㈳" at base 0 "sample_02.exe" loaded module "扤捧牯E楍楮畄灭敒摡畄灭瑓敲浡" at base 0 "sample_02.exe" loaded module "TQUERY" at base 72060000 "sample_02.exe" loaded module "SPP" at base 725e0000 "sample_02.exe" loaded module "PSAPI" at base 75b40000 "sample_02.exe" loaded module "ENDPOINTDLP" at base 0 "sample_02.exe" loaded module "ADVAPI" at base 03a:T49e,Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "sample_02.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "sample_02.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp")3b:T600,"sample_02.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: ""; Value: "") "sample_02.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VMBUS\PARAMETERS\WINSOCK"; Key: ""; Value: "") "sample_02.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: ""; Value: "") "sample_02.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS"; Key: ""; Value: "") "sample_02.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\PSCHED"; Key: ""; Value: "") "sample_02.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: ""; Value: "") "sample_02.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: ""; Value: "") "sample_02.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: ""; Value: "") "sample_02.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: ""; Value: "") "sample_02.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: ""; Value: "") "sample_02.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP"; Key: ""; Value: "") "sample_02.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SAMPLE_02.EXE"; Key: ""; Value: "")3c:Tb06,"sample_02.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "sample_02.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VMBUS\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "sample_02.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "sample_02.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\PSCHED"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "sample_02.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "sample_02.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "sample_02.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "sample_02.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "sample_02.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "sample_02.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "sample_02.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "MAXRPCSIZE"; Value: "") "sample_02.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "") "sample_02.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "OOBEINPROGRESS"; Value: "") "sample_02.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "sample_02.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "IDLETIMERWINDOW"; Value: "") "sample_02.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "SYNCMODE5"; Value: "") "sample_02.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE"; Key: "SESSIONSTARTTIMEDEFAULTDELTASECS"; Value: "") "sample_02.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}"; Key: "CATEGORY"; Value: "") "sample_02.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}"; Key: "NAME"; Value: "")3d:T68e,"sample_02.exe" trying to access non-existent file "C:\VERSION.DLL" "sample_02.exe" trying to access non-existent file "C:\WININET.DLL" "sample_02.exe" trying to access non-existent file "C:\WININET.dll" "sample_02.exe" trying to access non-existent file "C:\IEPROXY.DLL" "sample_02.exe" trying to access non-existent file "C:\ieproxy.DLL" "sample_02.exe" trying to access non-existent file "C:\MSSIP32.DLL" "sample_02.exe" trying to access non-existent file "C:\mssip32.DLL" "sample_02.exe" trying to access non-existent file "C:\SMARTSCREENPS.DLL" "sample_02.exe" trying to access non-existent file "C:\smartscreenps.DLL" "sample_02.exe" trying to access non-existent file "C:\Users\Public\LEEINZDK.EXE" "sample_02.exe" trying to access non-existent file "C:\Users\Public\leeinzdK.exe" "sample_02.exe" trying to access non-existent file "C:\AM.DLL" "sample_02.exe" trying to access non-existent file "C:\Am.DLL" "sample_02.exe" trying to access non-existent file "C:\Windows\SysWOW64\AM.DLL" "sample_02.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\Am.DLL" "sample_02.exe" trying to access non-existent file "C:\Windows\System\AM.DLL" "sample_02.exe" trying to access non-existent file "C:\WINDOWS\system\Am.DLL" "sample_02.exe" trying to access non-existent file "C:\Windows\AM.DLL" "sample_02.exe" trying to access non-existent file "C:\WINDOWS\Am.DLL" "sample_02.exe" trying to access non-existent file "C:\ProgramData\Oracle\Java\javapath_target_114250\AM.DLL" "sample_02.exe" trying to access non-existent file "C:\ProgramData\Oracle\Java\javapath\Am.DLL" "sample_02.exe" trying to access non-existent file "C:\WINDOWS\system32\Am.DLL"3e:T88a,Found registry query API: "RegQueryValueExA" in file "sample_02.exe" Found registry query API: "RegEnumValueA" in file "sample_02.exe" Found registry query API: "RegOpenKeyExA" in file "sample_02.exe" Found registry query API: "RegQueryValueExA" in "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp" Found registry query API: "RegGetValueW" in "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp" Found registry query API: "RegOpenKeyEx" in "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp" Found registry query API: "RegQueryInfoKey" in "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp" Found registry query API: "RegEnumValue" in "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp" Found registry query API: "RegGetValueW(ThirdPartyEncryptionProviderPath)" in "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp" Found registry query API: "RegOpenKeyEx(SYSTEM\CurrentControlSet\Control\EAS)" in "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp" Found registry query API: "RegEnumValueW" in "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp"3f:Ta3e,Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "sample_02.exe") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "sample_02.exe") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; File: "sample_02.exe") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "sample_02.exe") Found reference to API "GetDCOrgEx" (Indicator: "GetDC"; File: "sample_02.exe") Found reference to API "GetDCEx" (Indicator: "GetDC"; File: "sample_02.exe") Found reference to API "GetDC" (Indicator: "GetDC"; File: "sample_02.exe") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; File: "sample_02.exe") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "sample_02.exe") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005560.00000000.209109.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.03520000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005560.00000000.209109.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.03520000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00005560.00000000.209109.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.03520000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005560.00000000.209109.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.03520000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005560.00000000.209109.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.03520000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00005560.00000000.209109.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.03520000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00005560.00000000.209109.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.03520000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00005560.00000000.209109.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.03520000.00000004.mdmp")40:T148d,Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "sample_02.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "sample_02.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "sample_02.exe") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp") Found reference to API "Process32First" (Indicator: "Process32First"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp") Found reference to API "Process32Next" (Indicator: "Process32Next"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp") Found reference to API "Thread32First" (Indicator: "Thread32First"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp") Found reference to API "Thread32Next" (Indicator: "Thread32Next"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp") Found reference to API "Module32First" (Indicator: "Module32First"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp") Found reference to API "Module32Next" (Indicator: "Module32Next"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp") Found reference to API "Module32FirstW" (Indicator: "Module32First"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp") Found reference to API "Module32NextW" (Indicator: "Module32Next"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp") Found reference to API "EnumProcessModules" (Indicator: "EnumProcessModules"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API "GetModuleHandleExA" (Indicator: "GetModuleHandle"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp")41:T402,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "sample_02.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "sample_02.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp") Found reference to API "GetModuleHandleExA" (Indicator: "GetModuleHandle"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp")42:T926,Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API "NtQuerySecurityObject" (Indicator: "NtQuerySecurityObject"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp") Found reference to API "LsaLookupSids" (Indicator: "LsaLookupSids"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API "NetUserGetInfo" (Indicator: "NetUserGetInfo"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "NtOpenProcessToken"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API "NtQueryInformationToken" (Indicator: "NtQueryInformationToken"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "NtOpenThreadToken"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp")43:Tce6,Found reference to API "NtAccessCheck" (Indicator: "AccessCheck"; Source: "00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp") Found reference to API "CreateWellKnownSid(WinWorldSid)" (Indicator: "CreateWellKnownSid"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API "CreateWellKnownSid(WinLocalSystemSid)" (Indicator: "CreateWellKnownSid"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API "AuthzAccessCheck" (Indicator: "AccessCheck"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API "PrivilegeCheck" (Indicator: "PrivilegeCheck"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API "CreateWellKnownSid" (Indicator: "CreateWellKnownSid"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API "NtDuplicateToken" (Indicator: "DuplicateToken"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API "MakeAbsoluteSD" (Indicator: "MakeAbsoluteSD"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API "RtlInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API "RtlCopySid" (Indicator: "CopySid"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp") Found reference to API "RtlEqualSid" (Indicator: "EqualSid"; Source: "00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp")44:T9a1,"sample_02.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "sample_02.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VMBUS\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "sample_02.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "sample_02.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\PSCHED"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "sample_02.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "sample_02.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "sample_02.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "sample_02.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "sample_02.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "sample_02.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "sample_02.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "sample_02.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "sample_02.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "sample_02.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "sample_02.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "sample_02.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "")45:T8a2,Found string "GetLongPathNameA" (Source: sample_02.exe, API is part of module: KERNELBASE.DLL) Found string "GetDiskFreeSpaceExA" (Source: sample_02.exe, API is part of module: KERNELBASE.DLL) Found string "VariantChangeTypeEx" (Source: sample_02.exe, API is part of module: OLEAUT32.DLL) Found string "VarNeg" (Source: sample_02.exe, API is part of module: OLEAUT32.DLL) Found string "VarNot" (Source: sample_02.exe, API is part of module: OLEAUT32.DLL) Found string "VarAdd" (Source: sample_02.exe, API is part of module: OLEAUT32.DLL) Found string "VarSub" (Source: sample_02.exe, API is part of module: OLEAUT32.DLL) Found string "VarMul" (Source: sample_02.exe, API is part of module: OLEAUT32.DLL) Found string "VarDiv" (Source: sample_02.exe, API is part of module: OLEAUT32.DLL) Found string "VarIdiv" (Source: sample_02.exe, API is part of module: OLEAUT32.DLL) Found string "VarMod" (Source: sample_02.exe, API is part of module: OLEAUT32.DLL) Found string "VarAnd" (Source: sample_02.exe, API is part of module: OLEAUT32.DLL) Found string "VarOr" (Source: sample_02.exe, API is part of module: OLEAUT32.DLL) Found string "VarXor" (Source: sample_02.exe, API is part of module: OLEAUT32.DLL) Found string "VarCmp" (Source: sample_02.exe, API is part of module: OLEAUT32.DLL) Found string "VarI4FromStr" (Source: sample_02.exe, API is part of module: OLEAUT32.DLL) Found string "VarR4FromStr" (Source: sample_02.exe, API is part of module: OLEAUT32.DLL) Found string "VarR8FromStr" (Source: sample_02.exe, API is part of module: OLEAUT32.DLL) Found string "VarDateFromStr" (Source: sample_02.exe, API is part of module: OLEAUT32.DLL) Found string "VarCyFromStr" (Source: sample_02.exe, API is part of module: OLEAUT32.DLL) Found string "VarBoolFromStr" (Source: sample_02.exe, API is part of module: OLEAUT32.DLL) Found string "VarBstrFromCy" (Source: sample_02.exe, API is part of module: OLEAUT32.DLL) Found string "VarBstrFromDate" (Source: sample_02.exe, API is part of module: OLEAUT32.DLL) Found string "VarBstrFromBool" (Source: sample_02.exe, API is part of module: OLEAUT32.DLL) Found string "GetMonitorInfoA" (Source: sample_02.exe, API is part of module: USER32.DLL)46:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AeZeIiIiIiIiIiIiIiIiZmJn/////////////////+JmY//////////////////+JmZmZmZmZmZmZmZj/////iZmZmZmZmZmZmZmZ/////4mYmZmYiImYmZmZmf////+Jn3mZn5mIn3mZmZn/////iZ+IiJ+Zn5+IiZmZ/////4mfmX+fmYiYiZmZmf////+Jn4eIn4iIn4d5mZn/////iZiIiZiImZiIiZmZ/////4mZmZmZmZmZmZmZmf////+JmIiIiIiIiIiIiI//////iX///////////////////4l///////////////////+Jf///////////////////iX///////////////////4l///////////////////+Jf///////////////////iX///////////////////4l///////////////////+Jf///////////////////iX///////////////////4l///////////////////+Jf///////////////////iX//////////////////+Jl//////////////////4mYf/////////////////iZ/3////////////////95f/+f//////////////+JmP//mP/////////////4mY///5mYiIiIiIiIiIiIeZj///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==47:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AeZeIiIiIiIiIiIiIiIiZmJn/////////////////+JmY//////////////////+JmZmZmZmZmZmZmZj/////iZmZmZmZmZmZmZmZ/////4mYmZmYiImYmZmZmf////+Jn3mZn5mIn3mZmZn/////iZ+IiJ+Zn5+IiZmZ/////4mfmX+fmYiYiZmZmf////+Jn4eIn4iIn4d5mZn/////iZiIiZiImZiIiZmZ/////4mZmZmZmZmZmZmZmf////+JmIiIiIiIiIiIiI//////iX///////////////////4l///////////////////+Jf///////////////////iX///////////////////4l///////////////////+Jf///////////////////iX///////////////////4l///////////////////+Jf///////////////////iX///////////////////4l///////////////////+Jf///////////////////iX//////////////////+Jl//////////////////4mYf/////////////////iZ/3////////////////95f/+f//////////////+JmP//mP/////////////4mY///5mYiIiIiIiIiIiIeZj///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"5ee4fc645fa88cd85eddc57b9fc28733a891d0bb84a648a560264b983b9c5488","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791883238768,"unified_at":"2026-10-13T09:20:38.768Z","metadata":{"hashes":{"sha256":"5ee4fc645fa88cd85eddc57b9fc28733a891d0bb84a648a560264b983b9c5488","sha1":"a086831016916ac275933ab804d282d5df37bbe6","md5":"4d504f54785c1554c69d5127fad391c2","sha512":"eb81393b99c8e472bfc7f5baaee462f6aa83c0f3a53d0eb168302eb1691f562c4f9c585cfff4b9f52d16a6a76cd3db8021698d8dc7c58418b323bdd30f6cc9f0","ssdeep":"24576:i12P5hQ6ySsfIiWwXhx/N838dSDQKnrZlOOv3ciPK3W:ichJyt79NAruOPcp3W","ssdeep_chunks":["24576:i12P5hQ","24576:12P5hQ6","24576:2P5hQ6y","24576:P5hQ6yS","24576:5hQ6ySs","24576:hQ6ySsf","24576:Q6ySsfI","24576:6ySsfIi","24576:ySsfIiW","24576:SsfIiWw","24576:sfIiWwX","24576:fIiWwXh","24576:IiWwXhx","24576:iWwXhx/","24576:WwXhx/N","24576:wXhx/N8","24576:Xhx/N83","24576:hx/N838","24576:x/N838d","24576:/N838dS","24576:N838dSD","24576:838dSDQ","24576:38dSDQK","24576:8dSDQKn","24576:dSDQKnr","24576:SDQKnrZ","24576:DQKnrZl","24576:QKnrZlO","24576:KnrZlOO","24576:nrZlOOv","24576:rZlOOv3","24576:ZlOOv3c","24576:lOOv3ci","24576:OOv3ciP","24576:Ov3ciPK","24576:v3ciPK3","24576:3ciPK3W","49152:i12P5hQ","49152:12P5hQ6","49152:2P5hQ6y","49152:P5hQ6yS","49152:5hQ6ySs","49152:hQ6ySsf","49152:Q6ySsfI","49152:6ySsfIi","49152:ySsfIiW","49152:SsfIiWw","49152:sfIiWwX","49152:fIiWwXh","49152:IiWwXhx","49152:iWwXhx/","49152:WwXhx/N","49152:wXhx/N8","49152:Xhx/N83","49152:hx/N838","49152:x/N838d","49152:/N838dS","49152:N838dSD","49152:838dSDQ","49152:38dSDQK","49152:8dSDQKn","49152:dSDQKnr","49152:SDQKnrZ","49152:DQKnrZl","49152:QKnrZlO","49152:KnrZlOO","49152:nrZlOOv","49152:rZlOOv3","49152:ZlOOv3c","49152:lOOv3ci","49152:OOv3ciP","49152:Ov3ciPK","49152:v3ciPK3","49152:3ciPK3W","24576:ichJyt7","24576:chJyt79","24576:hJyt79N","24576:Jyt79NA","24576:yt79NAr","24576:t79NAru","24576:79NAruO","24576:9NAruOP","24576:NAruOPc","24576:AruOPcp","24576:ruOPcp3","24576:uOPcp3W"],"imphash":"bf908eefef1abcc17154da68f29113d5"},"file_info":{"file_name":"sample_02.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":1626624,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1757081355000,"last_seen":1760437029000,"last_multi_scan":1760437029000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["windows-server-utility","evasive"]},"stats":{"av":{"malicious_count":18,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":68},"sandbox_signatures":{"informative_count":175,"suspicious_count":24,"malicious_count":7,"total":206},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Downloader/Win.ModiLoader","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[PSW]/Win32.DarkCloud","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/AD.Swotter.tcmfj","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.77219280","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Trojan.Modiloader-10042434-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Trojan_Win32_Remcos_RSL_MTB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_90% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.77219280 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/TrojanDownloader.ModiLoader.AIS trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"TrojanDownloader/ModiLoader.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan-Downloader ( 005cc2c11 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.DarkCloud.lbzrrg","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/DBatLdr-X","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/ModiLoader.X.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.DelphGen.ITD","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan.Alogger","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Downloader.ModiLoader.Win32.694","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"suspicious","value":"Contains ability to retrieve the command-line string for the current process"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"suspicious","value":"Contains ability to retrieve the fully qualified path of module"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"malicious","value":"Contains native function calls"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Contains ability to access the loader directly (API string)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"References registry location(s) potentially used by malware"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"},{"type":"suspicious","value":"Contains ability to update the user profile"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"},{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Persistence","technique":"Office Application Startup","attack_id":"T1137","attack_id_wiki":"https://attack.mitre.org/techniques/T1137","identifiers":[{"type":"informative","value":"Contains reference to messaging system library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"informative","value":"Contains ability to create a remote thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Contains ability to modify process memory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Sets thread context in a remote process (often injection or process hollowing)"},{"type":"informative","value":"Contains ability to unmap view of a section from a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Privilege Escalation","technique":"Portable Executable Injection","attack_id":"T1055.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/002","identifiers":[{"type":"informative","value":"Attempts remote code execution into another process memory space"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Tries to detect debugger using ProcessDebugPort"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"},{"type":"informative","value":"Able to modify Windows Defender exclusions (Powershell command string)"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect sandbox (imports API)"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"},{"type":"informative","value":"Able to identify sandbox environment running process"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"},{"type":"informative","value":"Contains ability to query volume size"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"YARA signature match - RC4 Encryption"},{"type":"informative","value":"YARA signature match – ROR algorithm"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Loads the Bcrypt module DLL"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Spawns Windows crash diagnostic and reporting process"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"suspicious","value":"PE file contains unusual section name"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"informative","value":"YARA signature match - High entropy file"},{"type":"informative","value":"YARA signature match - Medium entropy File"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"},{"type":"suspicious","value":"Looks up many procedures within the same disassembly stream (often used to hide usage)"},{"type":"informative","value":"Loads syscall stubs from disk during runtime"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"suspicious","value":"Contains ability to hook/unhook windows functions"},{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"suspicious","value":"Contains ability to retrieve keyboard strokes"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"suspicious","value":"Contains ability to retrieve the specified system metric or system configuration setting"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Able to access Cisco VPN profile file"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve open application windows"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries for Borland Delphi related registry entry"},{"type":"informative","value":"Queries registry keys"},{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Contains reference to Borland Delphi related registry entry"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve system language"},{"type":"suspicious","value":"Contains ability to read the keyboard layout followed by a significant code branch decision"},{"type":"informative","value":"Able to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"},{"type":"informative","value":"Able to query service configuration on system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about user accounts on a server (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"suspicious","value":"Contains ability to read clipboard data"},{"type":"informative","value":"Able to capture drag-drop file operations"},{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"suspicious","value":"Contains ability to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Attempts to call internet-related API for network communication"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"suspicious","value":"Opens a handle to the specified local process"},{"type":"informative","value":"Able to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify Windows Defender exclusions (Powershell command string)","description":"Found reference string \"C:\\\\Users\\\\Public\\\\xkn -WindowStyle hidden -Command \"Add-MpPreference -ExclusionPath C:\\\"\" (Indicator: \"add-mppreference\"; Source: \"00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-980","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to create a remote thread (API string)","description":"Found reference to API \"NtCreateThreadEx\" (Indicator: \"NtCreateThread\"; Source: \"00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp\")\n Found reference to API \"NtOpenThreadToken\" (Indicator: \"OpenThreadToken\"; Source: \"00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; Source: \"00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-439","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegFlushKey\" (Indicator: \"RegFlushKey\"; File: \"sample_02.exe\")\n Found reference to API \"RegSetValueEx\" (Indicator: \"RegSetValue\"; Source: \"00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; File: \"sample_02.exe\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00005560.00000000.209109.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.03520000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \"??\\C:\\WINDOWS\\SYSTEM32\\Amsi.DLL\" (Indicator: \"amsi.dll\") in Source: 00000000-00005560.00000000.209109.03520000.00000004.mdmp\n Observed string: \":\\WINDOWS\\SYSTEM32\\Amsi.DLL\" (Indicator: \"amsi.dll\") in Source: 00000000-00005560.00000000.209109.03520000.00000004.mdmp\n 00000000-00005560.00000001.210599.03520000.00000004.mdmp\n Observed string: \"AmsiScanBuffer\" (Indicator: \"amsiscanbuffer\") in Source: 00000000-00005560.00000000.209109.05470000.00000004.mdmp\n 00000000-00005560.00000001.210599.05470000.00000004.mdmp\n 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00005560.00000000.209109.05470000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005560.00000001.210599.05470000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005560.00000001.210599.7DE00000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005560.00000001.210599.7DF10000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005560.00000001.210599.7E180000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005560.00000001.210599.7EA00000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$28","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Spawns Windows crash diagnostic and reporting process","description":"Process \"WerFault.exe\" [UID: 00000000-00003372]\n Process \"WerFault.exe\" [UID: 00000000-00001584]","origin":"Monitored Target","mitre_attack_id":"T1564","relevance":1,"id":"target-585","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"sample_02.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"sample_02.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"sample_02.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \".bss\" is zero\n Raw size of \".tls\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$29","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00005560.00000000.209109.03520000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: YARA signature match - RC4 Encryption\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to perform decryption (API string)\n Matched sigs: YARA signature match - RC4 Encryption\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - RC4 Encryption\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2a","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"etUserNameExA\" (Source: \"00000000-00005560.00000000.209109.03520000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify sandbox environment running process","description":"Found string \"VGAuthService.exe\" (Indicator: \"VGAuthService.exe\"; Source: \"00000000-00005560.00000000.209109.05270000.00000004.mdmp\")\n Found string \"vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; Source: \"00000000-00005560.00000000.209109.05270000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-666","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"sample_02.exe\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; File: \"sample_02.exe\")\n file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"leeinzdK.exe\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"Found string \"EnumServicesStatusA\" (Source: \"00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp\")\n Found string \"EnumServicesStatusW\" (Source: \"00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp\")\n Found string \"EnumServicesStatusExA\" (Source: \"00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp\")\n Found string \"EnumServicesStatusExW\" (Source: \"00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; File: \"sample_02.exe\")\n Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetDateFormatA\" (Indicator: \"GetDateFormat\"; File: \"sample_02.exe\")\n Found reference to API \"GetDateFormatA\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardLayoutList\" (Indicator: \"GetKeyboardLayoutList\"; File: \"sample_02.exe\")\n Found reference to API \"GetKeyboardLayoutNameA\" (Indicator: \"GetKeyboardLayout\"; File: \"sample_02.exe\")\n Found reference to API \"GetKeyboardType\" (Indicator: \"GetKeyboardType\"; File: \"sample_02.exe\")\n Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; File: \"sample_02.exe\")\n Found reference to API \"GetKeyboardType\" (Indicator: \"GetKeyboardType\"; Source: \"00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"SendMessageA\" (Indicator: \"sendmessage\"; File: \"sample_02.exe\")\n Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; File: \"sample_02.exe\")\n Found reference to API \"FindWindowA\" (Indicator: \"findwindow\"; File: \"sample_02.exe\")\n Found reference to API \"EnumChildWindows\" (Indicator: \"enumchildwindows\"; File: \"sample_02.exe\")\n Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; File: \"sample_02.exe\")\n Found reference to API \"PostMessageA\" (Indicator: \"postmessage\"; File: \"sample_02.exe\")\n Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00005560.00000000.209109.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.03520000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"sample_02.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00005560)\n \"sample_02.exe\" called \"EnumDisplayMonitors\" with parameters (UID: 00000000-00005560)\n \"sample_02.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00005560)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"sample_02.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005560)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"sample_02.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005560)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2d","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"sample_02.exe\" called \"GetVersionExA\" with parameter 940000000600000002000000f02300000200000000ffffff79e4e7772335da77c0fd3501a01952030100000047000000009047000a00000010001100b866530300000100d86d530310000000483c4000fcfd3501573c4000f4fd350160c05805947240000176400060c058052cfe35012ebf400020fe3501f93b400047000000ac904700a0d14000a62c4000915d400008000000 (UID: 00000000-00005560)\n \"sample_02.exe\" called \"GetVersionExA\" with parameter 940000000600000002000000f023000002000000001000000400000000000000000014000000fe2db8fa3501d715ee05000000000000140000100000040000006070f005d718ee0510000000f839ee0588fa3501073aee0580fa3501088d112e9463ee050166ee05088d112eb8fa3501b2aaee05acfa3501a939ee051b000000ac60f00584bbee050a2cee05a558ee0507000000 (UID: 00000000-00005560)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"sample_02.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00005560)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@kernel32.dll at 49615-2321-004067C0\n GetTickCount@kernel32.dll at 49615-3327-00401314","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; File: \"sample_02.exe\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"sample_02.exe\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetLocalTime@kernel32.dll at 49615-1684-00406778","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@kernel32.dll at 49615-2400-004366C8\n GetVersion@kernel32.dll at 49615-2420-004067C8\n GetVersionExA@kernel32.dll at 49615-3344-004067D0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoA@kernel32.dll at 49615-1465-00406780","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceA@kernel32.dll at 49615-1671-00406760","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.001","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"sample_02.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"sample_02.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"sample_02.exe\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"EnumWindows\" (Indicator: \"EnumWindows\"; File: \"sample_02.exe\")\n Found reference to API \"FindWindowA\" (Indicator: \"FindWindow\"; File: \"sample_02.exe\")\n Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; File: \"sample_02.exe\")\n Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"sample_02.exe\")\n Found reference to API \"GetWindowTextA\" (Indicator: \"GetWindowText\"; File: \"sample_02.exe\")\n Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language","description":"GetKeyboardType@user32.dll at 49615-370-0040367C\n GetKeyboardLayoutList@user32.dll at 49615-2264-0045B9E0\n GetKeyboardLayoutList@user32.dll at 49615-2267-00406CA8\n GetKeyboardLayoutNameA@user32.dll at 49615-2466-00439D34\n GetKeyboardLayoutNameA@user32.dll at 49615-2467-00406CB0\n GetKeyboardLayout@user32.dll at 49615-2476-00406CA0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614.001","relevance":3,"id":"stream-79","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"sample_02.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains reference to Borland Delphi related registry entry","description":"\"Software\\Borland\\Delphi\\Locales\" (Indicator: \"\\borland\\delphi\\locales\") in Source: sample_02.exe\n \"Software\\Borland\\Delphi\\Locales\" (Indicator: \"\\borland\\delphi\\locales\") in Source: 00000000-00005560.00000000.209109.05470000.00000004.mdmp\n 00000000-00005560.00000001.210599.00401000.00000020.mdmp\n 00000000-00005560.00000001.210599.05470000.00000004.mdmp\n 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp\n 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-324","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetVersion@kernel32.dll directly followed by \"cmp ax, 0004h\" and \"jc 00436877h\" at 49615-2400-004366C8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Environment Awareness","name":"Queries for Borland Delphi related registry entry","description":"\"sample_02.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\BORLAND\\DELPHI\\LOCALES\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-138","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"sample_02.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyEx\" in \"00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; Source: \"00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"leeinzdK.exe\")\n Found string \"GetCommandLineA\" (Source: \"00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"svchost.exe\"\n Report process \"WerFault.exe\" was created by \"leeinzdK.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"sample_02.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00005560)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$30","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$31","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"NtDeviceIoControlFile\" (Indicator: \"NtDeviceIoControlFile\"; Source: \"00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp\")\n Found reference to API \"NtDeviceIoControlFile\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@kernel32.dll at 49615-1514-0040D378\n Sleep@kernel32.dll at 49615-1604-00401350","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"sample_02.exe\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: sample_02.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryA@kernel32.dll at 49615-475-00406808\n LoadLibraryA@kernel32.dll at 49615-1455-00406800\n LoadLibraryA@kernel32.dll at 49615-2238-00427440\n LoadLibraryA@kernel32.dll at 49615-2828-0044E600\n LoadLibraryA@kernel32.dll at 49615-3332-00476A68","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$34","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"WinExec\" (Indicator: \"WinExec\"; Source: \"00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; File: \"sample_02.exe\")\n Found reference to API \"FindResourceA\" (Indicator: \"FindResource\"; File: \"sample_02.exe\")\n Found reference to API \"FreeResource\" (Indicator: \"FreeResource\"; File: \"sample_02.exe\")\n Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; File: \"sample_02.exe\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; File: \"sample_02.exe\")\n Found reference to API \"AuthzFreeResourceManager\" (Indicator: \"FreeResource\"; Source: \"00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileA\" (Indicator: \"MoveFile\"; Source: \"00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"sample_02.exe\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"sample_02.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"sample_02.exe\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"sample_02.exe\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"General","name":"Contains reference to messaging system library (API string)","description":"Found string \"MAPI32.DLL\" (Indicator: \"MAPI32.dll\"; File: \"sample_02.exe\")\n Found string \"MAPI32.DLL\" (Indicator: \"MAPI32.dll\"; Source: \"00000000-00005560.00000001.210599.00401000.00000020.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1137","relevance":1,"id":"string-571","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$37","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process sample_02.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:5560:168:WilStaging_02\"\n Process sample_02.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5560:168:WilStaging_02\"\n Process sample_02.exe created mutex with name \"SM0:5560:168:WilStaging_02\"\n Process sample_02.exe created mutex with name \"Local\\SM0:5560:168:WilStaging_02\"","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"sample_02.exe\" failed to load missing module \"Am\" - [base:0; Status:c0000135]\n \"sample_02.exe\" failed to load missing module \"换祲瑰\" - [base:0; Status:c0000135]\n \"sample_02.exe\" failed to load missing module \"瑮汤l\" - [base:0; Status:c0000135]\n \"sample_02.exe\" failed to load missing module \"流\" - [base:0; Status:c0000135]\n \"sample_02.exe\" failed to load missing module \"摡慶楰㈳\" - [base:0; Status:c0000135]\n \"sample_02.exe\" failed to load missing module \"扤捧牯e楍楮畄灭敒摡畄灭瑓敲浡\" - [base:0; Status:c0000135]\n \"sample_02.exe\" failed to load missing module \"endpointdlp\" - [base:0; Status:c0000135]\n \"sample_02.exe\" failed to load missing module \"Advapi\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$38","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$39","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"sample_02.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 72B40000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"sample_02.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75AE0000\n \"sample_02.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73BC0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"sample_02.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 750C0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"sample_02.exe\" was detected as \"Borland Delphi\" and name: \"Compiler\"\n \"sample_02.exe\" was detected as \"Turbo Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"sample_02.exe\" has an executable section named \".text\"\n \"sample_02.exe\" has an executable section named \".itext\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"sample_02.exe\" has an writable section named \".data\"\n \"sample_02.exe\" has an writable section named \".bss\"\n \"sample_02.exe\" has an writable section named \".idata\"\n \"sample_02.exe\" has an writable section named \".tls\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"sample_02.exe\" file has an entrypoint instructions - \"push\tebp,mov\tebp, esp,add\tesp, -0x10,mov\teax, 0x4789c8,call\t0x406548,mov\teax, dword ptr [0x57b0ec],mov\teax, dword ptr [eax],call\t0x45e004,mov\tecx, dword ptr [0x57af0c],mov\teax, dword ptr [0x57b0ec],mov\teax, dword ptr [eax],mov\tedx, dword ptr [0x47818c],call\t0x45e01c,mov\teax, dword ptr [0x57b0ec],mov\teax, dword ptr [eax],call\t0x45e09c,call\t0x4045e4,lea\teax, [eax],add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".data\" is \"0x101400\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".data\" is \"0x10127c\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"leeinzdK.exe\" (UID: 00000000-00004864) was launched with new environment variables: \"USERDNSDOMAIN=\"DESKTOP-FVVF82A\", PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"leeinzdK.exe\" (UID: 00000000-00004864) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"sample_02.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"sample_02.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"sample_02.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"leeinzdK.exe\" with commandline \"C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\leeinzdK.exe\" (UID: 00000000-00004864)\n Spawned process \"WerFault.exe\" with commandline \"-pss -s 440 -p 4864 -ip 4864\" (UID: 00000000-00003372)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 4864 -s 8\" (UID: 00000000-00001584)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"leeinzdK.exe\" with commandline \"C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\leeinzdK.exe\" (UID: 00000000-00004864)\n Spawned process \"WerFault.exe\" with commandline \"-pss -s 440 -p 4864 -ip 4864\" (UID: 00000000-00003372)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 4864 -s 8\" (UID: 00000000-00001584)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"sample_02.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Installation/Persistence","name":"Attempts remote code execution into another process memory space","description":"\"sample_02.exe\" called \"NtWriteVirtualMemory\" with parameters {\"ProcessHandle\": \"0\"\n \"BaseAddress\": \"0135FD18\"\n \"Buffer\": \"0047C15C\"\n \"NumberOfBytesToWrite\": \"00000004\"}\n \"sample_02.exe\" called \"NtWriteVirtualMemory\" with parameters {\"ProcessHandle\": \"0\"\n \"BaseAddress\": \"0135FCF0\"\n \"Buffer\": \"0047C15C\"\n \"NumberOfBytesToWrite\": \"00000004\"}\n \"sample_02.exe\" called \"NtWriteVirtualMemory\" with parameters {\"ProcessHandle\": \"0\"\n \"BaseAddress\": \"0135FCC0\"\n \"Buffer\": \"0047C15C\"\n \"NumberOfBytesToWrite\": \"00000004\"}","origin":"API Call","mitre_attack_id":"T1055.002","relevance":1,"id":"api-315","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to access the loader directly (API string)","description":"Found reference to API \"LdrLoadDll\" (Indicator: \"LdrLoadDll\"; Source: \"00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1129","relevance":1,"id":"string-548","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)","description":"Found reference to API \"NtQueueApcThread\" (Indicator: \"QueueApcThread\"; Source: \"00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.004","relevance":1,"id":"string-255","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"sample_02.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"sample_02.exe\" queries basic process information of the \"C:\\sample_02.exe\" (UID: 5560)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"sample_02.exe\" reads file \"c:\\sample_02.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify sandbox environment running process\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Contains ability to detect sandbox (imports API)\n Matched sigs: Contains ability to detect virtual environment (API)\n Matched sigs: Makes a code branch decision directly after an API that is environment aware\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to delay the execution of current thread\n Matched sigs: Contains ability to query volume size","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"sample_02.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"sample_02.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"sample_02.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\msimg32.dll\"\n \"sample_02.exe\" trying to touch file \"C:\\VERSION.DLL\"\n \"sample_02.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\version.dll\"\n \"sample_02.exe\" trying to touch file \"C:\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.248_none_5d7c08dba7db7edd\\comctl32.dll\"\n \"sample_02.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"sample_02.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ole32.dll\"\n \"sample_02.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\imm32.dll\"\n \"sample_02.exe\" trying to touch file \"C:\\Windows\\WindowsShell.Manifest\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$3d","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"sample_02.exe\" writes file \"c:\\users\\public\\leeinzdk.exe\"\n \"sample_02.exe\" writes file \"%public%\\leeinzdk.exe\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve information about user accounts on a server (API string)","description":"Found reference to API \"NetUserGetInfo\" (Indicator: \"NetUserGetInfo\"; Source: \"00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1087.001","relevance":1,"id":"string-112","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"p_i2#mr.py\"\n Pattern match: \"http://www.w3.org/2001/xmlschema-instance\"\n Heuristic match: \"vu.ai\"\n Heuristic match: \"n3.gt\"\n Heuristic match: \"cd.ax\"\n Heuristic match: \"[i.la\"\n Heuristic match: \"x..je\"\n Pattern match: \"http://schemas.microsoft.com/smi/2005/windowssettings\"\n Pattern match: \"www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a\"\n Pattern match: \"www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0\"\n Pattern match: \"crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z\"\n Pattern match: \"http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0\"\n Pattern match: \"http://www.microsoft.com/windows0\"\n Pattern match: \"crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z\"\n Pattern match: \"http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0\"\n Pattern match: \"www.microsoft.com/pki/docs/cps/default.htm0@\"\n Heuristic match: \"o}sr.om\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - High entropy file","description":"YARA signature to detect high entropy file process \"00000000-00005560\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":5,"id":"yara-605","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Medium entropy File","description":"YARA signature to detect medium entropy file file \"sample.bin\"\n YARA signature to detect medium entropy file process \"00000000-00005560\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":5,"id":"yara-606","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on file \"sample.bin\"\n YARA signature for RC4 encryption matched on process \"00000000-00005560\"","origin":"YARA Signature","mitre_attack_id":"T1027","id":"yara-104","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – ROR algorithm","description":"YARA signature matched on R0R instruction used in file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":1,"id":"yara-209","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"ncalrpc\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access Cisco VPN profile file","description":"Found string \"%.PcfuX\" (Indicator: \".pcf\"; Source: \"00000000-00005560.00000001.210599.2E25A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-866","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"GetClipboardData\" (File: \"sample_02.exe\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetNtProductType\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: sample_02.exe]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; File: \"sample_02.exe\")\n Found reference to API \"MapVirtualKeyA\" (Indicator: \"MapVirtualKey\"; File: \"sample_02.exe\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; File: \"sample_02.exe\")\n Found reference to API \"GetKeyNameTextA\" (Indicator: \"GetKeyNameText\"; File: \"sample_02.exe\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"sample_02.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; File: \"sample_02.exe\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: sample_02.exe)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; File: \"sample_02.exe\")\n Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"sample_02.exe\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp\")\n Found reference to API \"NtReadFile\" (Indicator: \"NtReadFile\"; Source: \"00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"sample_02.exe\")\n Found reference to API \"LdrGetProcedureAddress\" (Indicator: \"LdrGetProcedureAddress\"; Source: \"00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"sample_02.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileVersionInfoSizeA\" (Indicator: \"GetFileVersionInfo\"; File: \"sample_02.exe\")\n Found reference to API \"GetFileVersionInfoSizeA\" (Indicator: \"GetFileVersionInfoSize\"; File: \"sample_02.exe\")\n Found reference to API \"GetFileVersionInfoA\" (Indicator: \"GetFileVersionInfo\"; File: \"sample_02.exe\")\n Found reference to API \"GetFileAttributesA\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp\")\n Found reference to API \"NtQueryInformationFile\" (Indicator: \"QueryInformationFile\"; Source: \"00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"Found string \"where = an HTML Help project file\" (Indicator: \"where \"; Source: \"00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-484","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"sample_02.exe\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"sample_02.exe\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.00401000.00000020.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"sample_02.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"onecore\\ds\\security\\eas\\policyengine\\evallib\\passwordprovider.cpp\" (Indicator: \"password\"; Source: \"00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp\")\n Found string \"Agg password properties are NULL\" (Indicator: \"password\"; Source: \"00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteValue\" in \"00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp\"\n Found registry deletion API: \"RegDeleteKey\" in \"00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp\"\n Found registry deletion API: \"RegDeleteValue(ThirdPartyEncryptionProviderPath)\" in \"00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp\"\n Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp\"\n Found registry deletion API: \"RegDeleteTreeW\" in \"00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"NtOpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp\")\n Found string \"NtOpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp\")\n Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00005560.00000000.209109.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.03520000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcessAsUser\"; Source: \"00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp\")\n Found reference to API \"CreateProcessAsUserA\" (Indicator: \"CreateProcessAsUser\"; Source: \"00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp\")\n Found reference to API \"CreateProcessWithLogonW\" (Indicator: \"CreateProcessWithLogon\"; Source: \"00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"NtDeleteFile\" (Indicator: \"DeleteFile\"; Source: \"00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"SetWindowsHookExA\" (Indicator: \"SetWindowsHook\"; File: \"sample_02.exe\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; File: \"sample_02.exe\")\n Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; File: \"sample_02.exe\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; File: \"sample_02.exe\")\n Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"sample_02.exe\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"sample_02.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.03520000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp, 00000000-00005560.00000001.210599.7EA00000.00000004.mdmp\")\n Found reference to API \"NtWriteFile\" (Indicator: \"NtWriteFile\"; Source: \"00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$44","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; Source: \"00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp, 00000000-00005560.00000001.210599.7DE00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"smss.exe,csrss.exe,wininit.exe,winlogon.exe,services.exe\" (Source: \"00000000-00005560.00000000.209109.05270000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"}]},{"level":"informative","category":"Unusual Characteristics","name":"Found Delphi 4 - Delphi 2006 artifact","description":"\"sample_02.exe\" has a PE timestamp using the buggy magic timestamp 0x2A425E19.","origin":"Static Parser","relevance":10,"id":"static-19","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$45","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"sample_02.exe\" was detected as \"BobSoft Mini Delphi -> BoB / BobSoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"RuntimeBroker.exe\" (Indicator: \"runtimebroker.exe\")\n \"backgroundTaskHost.exe\" (Indicator: \"backgroundtaskhost.exe\")\n \"easinvoker.exe\" (Indicator: \"easinvoker.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"sample_02.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Unusual Characteristics","name":"References registry location(s) potentially used by malware","description":"Observed string: \"C:\\\\Users\\\\Public\\\\alpha /c C:\\\\Users\\\\Public\\\\ger add HKCU\\Software\\Classes\\ms-settings\\shell\\open\\command /f /ve /t REG_SZ /d\" (Indicator: \"ms-settings\\shell\\open\") in Source: 00000000-00005560.00000000.209109.05470000.00000004.mdmp\n 00000000-00005560.00000001.210599.03520000.00000004.mdmp\n 00000000-00005560.00000001.210599.05470000.00000004.mdmp\n 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-428","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Looks up many procedures within the same disassembly stream (often used to hide usage)","description":"Found 47 calls to GetProcAddress@kernel32.dll at 49615-2238-00427440\n Found 11 calls to GetProcAddress@kernel32.dll at 49615-2828-0044E600\n Found 12 calls to GetProcAddress@kernel32.dll at 49615-9653-00433F10","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.007","relevance":10,"id":"stream-40","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"sample_02.exe\" has section name .text with entropy \"6.536029436883937\"\n \"sample_02.exe\" has section name .data with entropy \"6.6086764511276614\"\n \"sample_02.exe\" has section name .reloc with entropy \"6.661061987758115\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Tries to detect debugger using ProcessDebugPort","description":"\"sample_02.exe queries ProcessDebugPort (UID: 5560)","origin":"API Call","mitre_attack_id":"T1622","relevance":5,"id":"api-238","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Contains ability to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00005560.00000000.209109.03520000.00000004.mdmp\")\n Found api reference \"BCryptVerifySignature\" (Indicator: \"BCryptVerifySignature\"; Source: \"00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp\")\n Found api reference \"BCryptQueryProviderRegistration\" (Indicator: \"BCryptQueryProviderRegistration\"; Source: \"00000000-00005560.00000000.209109.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05470000.00000004.mdmp, 00000000-00005560.00000001.210599.05EE1000.00000020.mdmp, 00000000-00005560.00000001.210599.2DFE0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":2,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleA@kernel32.dll at 49615-464-0046016C\n GetModuleHandleA@kernel32.dll at 49615-466-00406798\n GetModuleHandleA@kernel32.dll at 49615-468-004600A0\n GetModuleHandleA@kernel32.dll at 49615-1743-0040E36C\n GetModuleHandleA@kernel32.dll at 49615-1744-00406790\n GetModuleHandleA@kernel32.dll at 49615-2828-0044E600\n GetModuleHandleA@kernel32.dll at 49615-2829-0044E9F8\n GetModuleHandleA@kernel32.dll at 49615-2893-00450518\n GetModuleHandleW@kernel32.dll at 49615-3108-0045FFD8\n GetModuleHandleW@kernel32.dll at 49615-3109-004067A0\n GetModuleHandleA@kernel32.dll at 49615-3342-0040D478\n GetModuleHandleA@kernel32.dll at 49615-9653-00433F10","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve open application windows","description":"GetWindowTextA@user32.dll at 49615-3091-00406D90\n GetForegroundWindow@user32.dll at 49615-3937-00406C80","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1010","relevance":3,"id":"stream-125","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoA@kernel32.dll at 49615-365-0040127C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the specified system metric or system configuration setting","description":"GetSystemMetrics@user32.dll at 49615-1479-00406D50\n GetSystemMetrics@user32.dll at 49615-2082-0041CC78","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-122","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"17/26 Antivirus vendors marked sample as malicious (65% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"LockResource@kernel32.dll at 49615-1869-00406818\n SizeofResource@kernel32.dll at 49615-1870-00406860\n LoadResource@kernel32.dll at 49615-1872-00406810\n FindResourceA@kernel32.dll at 49615-1873-00406718\n FreeResource@kernel32.dll at 49615-9321-00406738","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"sample_02.exe\" wrote 51472 bytes starting with PE header signature to file \"C:\\Users\\Public\\leeinzdK.exe\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"suspicious","category":"Network Related","name":"Attempts to call internet-related API for network communication","description":"\"sample_02.exe\" called \"NtConnectPort\" with parameters (UID: 00000000-00005560)\n \"sample_02.exe\" called \"NtRequestWaitReplyPort\" with parameters (UID: 00000000-00005560)\n \"sample_02.exe\" called \"NtAlpcConnectPortEx\" with parameters (UID: 00000000-00005560)\n \"sample_02.exe\" called \"NtAlpcSendWaitReceivePort\" with parameters (UID: 00000000-00005560)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-291","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"sample_02.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00005560.00000000.209109.05270000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to read clipboard data","description":"GetClipboardData@user32.dll at 49615-2185-00406C48","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1115","relevance":5,"id":"stream-74","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve keyboard strokes","description":"GetKeyState@user32.dll at 49615-566-00406C98\n GetKeyNameTextA@user32.dll at 49615-2387-00406C90\n MapVirtualKeyA@user32.dll at 49615-2388-00406E58\n GetKeyboardState@user32.dll at 49615-2622-00406CB8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1056.001","relevance":8,"id":"stream-12","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the command-line string for the current process","description":"GetCommandLineA@kernel32.dll at 49615-366-00401254","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-118","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module","description":"GetModuleFileNameA@kernel32.dll at 49615-1701-00406788\n GetModuleFileNameA@kernel32.dll at 49615-2832-0045C748","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-131","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to hook/unhook windows functions","description":"SetWindowsHookExA@user32.dll at 49615-2282-00406FB0\n CallNextHookEx@user32.dll at 49615-3060-00406AF0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1056.001","relevance":5,"id":"stream-107","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"}]},{"level":"suspicious","category":"System Security","name":"Opens a handle to the specified local process","description":"\"sample_02.exe\" opens a process \"C:\\sample_02.exe\" (UID: 00000000-00005560)","origin":"API Call","mitre_attack_id":"T1489","relevance":1,"id":"api-284","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegOpenKeyExA\n RegCloseKey\n GetProcAddress\n GetVersionExA\n WriteFile\n GetStartupInfoA\n GetModuleHandleA\n GetModuleHandleW\n LoadLibraryExA\n FindResourceA\n GetTickCount\n VirtualAlloc\n CreateThread\n UnhandledExceptionFilter\n GetModuleFileNameA\n GetCommandLineA\n LoadLibraryA\n CreateFileA\n LockResource\n Sleep\n FindFirstFileA\n FindWindowA\n GetLastActivePopup\n GetCursorPos\n GetClipboardData\n SetWindowsHookExA\n GetWindowThreadProcessId","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"PE file contains unusual section name","description":"\"sample_02.exe\" has a section named \".itext\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-60","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_90% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"17/26 Antivirus vendors marked sample as malicious (65% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"malicious","category":"Installation/Persistence","name":"Sets thread context in a remote process (often injection or process hollowing)","description":"\"sample_02.exe\" set thread context in remote process \"%PUBLIC%\\leeinzdK.exe\" (PID: 1300)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-14","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"sample_02.exe\" wrote 00000004 bytes to a remote process \"C:\\Users\\Public\\leeinzdK.exe\" (Handle: 1148)\n \"sample_02.exe\" wrote 1CDE6616 bytes to a remote process \"C:\\Users\\Public\\leeinzdK.exe\" (Handle: 1148)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"Typical_Malware_String_Transforms\" matched process \"00000000-00005560\" as \"Detects typical strings in a reversed or otherwise modified form\" (Reference: Internal Research, Author: Florian Roth)","origin":"YARA Signature","relevance":9,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads syscall stubs from disk during runtime","description":"\"leeinzdK.exe\" trying to read a file \"C:\\Windows\\SysWOW64\\ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1027.007","relevance":3,"id":"api-298","sources":[{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileA@KERNEL32.DLL at 00000000-00007808-40039-92-00405940","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"sample_02.exe\" trying to access non-existent file \"C:\\Windows\\SystemResources\\user32.dll.mun\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on process \"00000000-00008676\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"sample_02.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to read the keyboard layout followed by a significant code branch decision","description":"Found API call GetKeyboardLayout@USER32.DLL directly followed by \"cmp ebx, dword ptr [0047B554h]\" and \"je 00439F06h\" at 00000000-00007808-40039-2018-00439ED8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614.001","relevance":10,"id":"stream-61","sources":[{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains ability to update the user profile","description":"SystemParametersInfoA@USER32.DLL at 00000000-00007808-40039-1688-0041CEC0\n SystemParametersInfoA@USER32.DLL at 00000000-00007808-40039-1689-0041CF94\n SystemParametersInfoA@USER32.DLL at 00000000-00007808-40039-1690-0041D068\n SystemParametersInfoA@USER32.DLL at 00000000-00007808-40039-1997-0043831C\n SystemParametersInfoA@USER32.DLL at 00000000-00007808-40039-2243-0044ACE0\n SystemParametersInfoA@USER32.DLL at 00000000-00007808-40039-2359-0045BD2C\n SystemParametersInfoA@USER32.DLL at 00000000-00007808-40039-2367-0044E59C\n SystemParametersInfoA@USER32.DLL at 00000000-00007808-40039-2368-0044E4FC\n SystemParametersInfoA@USER32.DLL at 00000000-00007808-40039-2560-0045C324\n SystemParametersInfoA@USER32.DLL at 00000000-00007808-40039-2581-0045C604\n SystemParametersInfoA@USER32.DLL at 00000000-00007808-40039-2582-0045C5D4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1098","relevance":5,"id":"stream-123","sources":[{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtWriteVirtualMemory@NTDLL.DLL at 00000000-00007808-40039-146-0045FF00\n NtdllDefWindowProc_A@NTDLL.DLL at 00000000-00007808-40039-1917-00406B50\n NtdllDefWindowProc_A@NTDLL.DLL at 00000000-00007808-40039-2033-0043AB2C\n NtdllDefWindowProc_A@NTDLL.DLL at 00000000-00007808-40039-2191-00446678\n NtdllDefWindowProc_A@NTDLL.DLL at 00000000-00007808-40039-2579-0045D8D4\n NtdllDefWindowProc_A@NTDLL.DLL at 00000000-00007808-40039-2586-0045D998","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Contains ability to read clipboard data"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"}],"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Contains ability to read the keyboard layout followed by a significant code branch decision"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":6,"imported_dlls_count":78,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":2,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["windows-server-utility","evasive"],"sample_flags":["Multi-Process","Sample Crashed"],"sandbox_reports":[{"id":"68ee23240d77867ffb0c8b76","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"sample_02.exe","analysis_start_time":"2025-10-14T10:17:09+00:00","indicators_count":{"informative":170,"suspicious":28,"malicious":6},"tags":["Multi-Process","Sample Crashed"],"is_in_unified_schema":true},{"id":"68edfbe853f77d08250a93fe","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"sample_02.exe","analysis_start_time":"2025-10-14T07:29:45+00:00","indicators_count":{"informative":169,"suspicious":30,"malicious":7},"tags":["Multi-Process"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"}],"processes":[{"pid":5560,"ppid":0,"name":"sample_02.exe","command_line":"","sha256":"5ee4fc645fa88cd85eddc57b9fc28733a891d0bb84a648a560264b983b9c5488","normalized_path":"C:\\sample_02.exe","uid":"00000000-00005560","icon":"$46"},{"pid":4864,"ppid":5560,"name":"leeinzdK.exe","command_line":"C:\\\\Users\\\\Public\\\\leeinzdK.exe","sha256":"3e96894609819ae3d595ff6e0fbe9ce6c9ac17bdeda256b994831992f668cb99","normalized_path":"%PUBLIC%\\leeinzdK.exe","parent_uid":"00000000-00005560","uid":"00000000-00004864"},{"pid":1584,"ppid":4864,"name":"WerFault.exe","command_line":"-u -p 4864 -s 8","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004864","uid":"00000000-00001584"},{"pid":3372,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 440 -p 4864 -ip 4864","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00003372","icon":"$47"}],"all_imported_dlls":["winhttp.dll","fltLib.dll","samcli.dll","smartscreenps.dll","msimg32.dll","KernelBase.dll","combase.dll","sechost.dll","msctf.dll","ws2_32.dll","cryptbase.dll","dwmapi.dll","winnsi.dll","mssip32.dll","tquery.dll","vssapi.dll","wow64cpu.dll","gdi32.dll","shlwapi.dll","powrprof.dll","amsi.dll","ucrtbase.dll","msvcrt.dll","bcryptprimitives.dll","gdi32full.dll","ole32.dll","IPHLPAPI.DLL","crypt32.dll","ntdll.dll","version.dll","SHCore.dll","kernel.appcore.dll","netapi32.dll","netutils.dll","ieproxy.dll","spp.dll","url.dll","cfgmgr32.dll","profapi.dll","winmmbase.dll","mswsock.dll","nsi.dll","vsstrace.dll","win32u.dll","shell32.dll","wkscli.dll","wintrust.dll","cryptdll.dll","wow64.dll","cryptsp.dll","ieframe.dll","bcrypt.dll","msasn1.dll","psapi.dll","kernel32.dll","msvcp_win.dll","imm32.dll","VxSSL32.dll","userenv.dll","wininet.dll","comctl32.dll","user32.dll","apphelp.dll","oleaut32.dll","rpcrt4.dll","winmm.dll","sppc.dll","wow64win.dll","sspicli.dll","advapi32.dll","uxtheme.dll","windows.storage.dll","iertutil.dll","OnDemandConnRouteHelper.dll","WinTypes.dll","wow64con.dll","wow64base.dll","SearchIndexerCore.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"path":"%PUBLIC%\\leeinzdK.exe","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"},{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\TENANTRESTRICTIONS\\PAYLOAD\\","sources":[{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5560:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5560:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"}]},{"name":"SM0:5560:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"}]},{"name":"Local\\SM0:5560:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68ee23240d77867ffb0c8b76"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8676:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]},{"name":"Local\\SM0:8676:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68edfbe853f77d08250a93fe"}]}]}},"report_ids":{"sandbox_job_ids":["68ee23240d77867ffb0c8b76","68edfbe853f77d08250a93fe"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 5ee4fc645fa8… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 5ee4fc645fa8…. Malware family: Trojan.Generic. Threat score 100/100. 18/27 AV engines flagged this file. 7 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/5ee4fc645fa88cd85eddc57b9fc28733a891d0bb84a648a560264b983b9c5488"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 5ee4fc645fa8… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 5ee4fc645fa8…. Malware family: Trojan.Generic. Threat score 100/100. 18/27 AV engines flagged this file. 7 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/5ee4fc645fa88cd85eddc57b9fc28733a891d0bb84a648a560264b983b9c5488"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 5ee4fc645fa8… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 5ee4fc645fa8…. Malware family: Trojan.Generic. Threat score 100/100. 18/27 AV engines flagged this file. 7 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L48","11",{}]]