24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 35:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T44b,{"@context":"https://schema.org","@type":"TechArticle","headline":"Clean Sample f4c8369e4de1… — Score 0/100 — Hybrid Analysis","description":"Clean verdict for sample f4c8369e4de1…. Threat score 0/100. 0/24 AV engines flagged this file. 2 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/f4c8369e4de1f12cc5a71eb5586b38fc78a9d8db2b189b8c25ef17a572d4d6b7","keywords":["Clean","malware analysis","sandbox report","threat intelligence","f4c8369e4de1f12cc5a71eb5586b38fc78a9d8db2b189b8c25ef17a572d4d6b7"],"about":{"@type":"SoftwareApplication","name":"F4C8369E4DE1F12CC5A71EB5586B38FC78A9D8DB2B189B8C25EF17A572D4D6B7","applicationCategory":["peexe","64bits","executable"],"identifier":"f4c8369e4de1f12cc5a71eb5586b38fc78a9d8db2b189b8c25ef17a572d4d6b7","additionalType":"Clean sample"},"threatScore":0,"antivirusDetections":{"malicious":0,"total":24},"behavioralIndicators":{"malicious":2,"suspicious":21},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T440,"Software\Sysinternals\%s" "Software\Microsoft\windows nt\currentversion" "Failed to delete: HKLM\SOFTWARE\%sMicrosoft\Windows NT\CurrentVersion\AeDebug\ProcDump\" "Failed to set: HKLM\SOFTWARE\%sMicrosoft\Windows NT\CurrentVersion\AeDebug\Auto" "Failed to set: HKLM\SOFTWARE\%sMicrosoft\Windows NT\CurrentVersion\AeDebug\Debugger" "HKLM\SOFTWARE\%sMicrosoft\Windows NT\CurrentVersion\AeDebug" "ProcDump's backup key is missing. Defaulting to value deletion. HKLM\SOFTWARE\%sMicrosoft\Windows NT\CurrentVersion\AeDebug\ProcDump\" "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug" "Failed to open: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug" "Failed to open: HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\AeDebug" "SOFTWARE\Microsoft\.NETFramework" "SOFTWARE\Microsoft\Silverlight" "SOFTWARE\Microsoft\Windows Kits\Installed Roots" "SOFTWARE\Microsoft\DebuggingTools" "ed to delete: HKLM\SOFTWARE\%sMicrosoft\Windows NT\CurrentVersion\AeDebug\ProcDump\" "to open: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug"26:T597,Pattern match: "www.microsoft.com/exporting" Pattern match: "www.microsoft.com" Pattern match: "crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0X" Pattern match: "http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl0Z" Pattern match: "http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T" Pattern match: "www.microsoft.com/pki/certs/MicrosoftRootCert.crt0" Pattern match: "http://www.sysinternals.com" Pattern match: "www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0" Pattern match: "www.microsoft.com/pkiops/docs/primarycps.htm0@" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z" Pattern match: "http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0" Pattern match: "www.microsoft.com/PKI/docs/CPS/default.htm0@" Pattern match: "crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z" Pattern match: "http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0" Pattern match: "www.sysinternals.com"27:T2114,"\pard\brdrb\brdrs\brdrw10\brsp20 \sb120\sa120\b\f0\fs24 SYSINTERNALS SOFTWARE LICENSE TERMS\fs28\par" (Indicator: "sysinternals") "\pard\sb120\sa120\b0\fs19 These license terms are an agreement between Sysinternals (a wholly owned subsidiary of Microsoft Corporation) and you. Please read them. They apply to the software you are downloading from Systinternals.com, which includes the media on which you received it, if any. The terms also apply to any Sysinternals\par" (Indicator: "sysinternals") "\caps\fs20 2.\tab\fs19 Scope of License\caps0 .\b0 The software is licensed, not sold. This agreement only gives you some rights to use the software. Sysinternals reserves all other rights. Unless applicable law gives you more rights despite this limitation, you may use the software only as expressly permitted in this agreement. In doing so, you must comply with any technical limitations in the software that only allow you to use it in certain ways. You may not\b\par" (Indicator: "sysinternals") "\pard\fi-357\li357\sb120\sa120\tx360\b\fs20 3.\tab SENSITIVE INFORMATION. \b0 Please be aware that, similar to other debug tools that capture \ldblquote process state\rdblquote information, files saved by Sysinternals tools may include personally identifiable or other sensitive information (such as usernames, passwords, paths to files accessed, and paths to registry accessed). By using this software, you acknowledge that you are aware of this and take sole responsibility for any personally identifiable or other sensitive information provided to Microsoft or any other party through your use of the software.\b\par" (Indicator: "sysinternals") "\fs20 11.\tab\fs19 Disclaimer of Warranty.\caps0 \caps The software is licensed "as - is." You bear the risk of using it. SYSINTERNALS gives no express warranties, guarantees or conditions. You may have additional consumer rights under your local laws which this agreement cannot change. To the extent permitted under your local laws, SYSINTERNALS excludes the implied warranties of merchantability, fitness for a particular purpose and non-infringement.\par" (Indicator: "sysinternals") "\pard\fi-360\li360\sb120\sa120\tx360\fs20 12.\tab\fs19 Limitation on and Exclusion of Remedies and Damages. You can recover from SYSINTERNALS and its suppliers only direct damages up to U.S. $5.00. You cannot recover any other damages, including consequential, lost profits, special, indirect or incidental damages.\par" (Indicator: "sysinternals") "\pard\li360\sb120\sa120 It also applies even if Sysinternals knew or should have known about the possibility of the damages. The above limitation or exclusion may not apply to you because your country may not allow the exclusion or limitation of incidental, consequential or other damages.\par" (Indicator: "sysinternals") "\pard\sb120\sa120 EXON\'c9RATION DE GARANTIE.\b0 Le logiciel vis\'e9 par une licence est offert \'ab tel quel \'bb. Toute utilisation de ce logiciel est \'e0 votre seule risque et p\'e9ril. Sysinternals n'accorde aucune autre garantie expresse. Vous pouvez b\'e9n\'e9ficier de droits additionnels en vertu du droit local sur la protection dues consommateurs, que ce contrat ne peut modifier. La ou elles sont permises par le droit locale, les garanties implicites de qualit\'e9 marchande, d'ad\'e9quation \'e0 un usage particulier et d'absence de contrefa\'e7on sont exclues.\par" (Indicator: "sysinternals") "\pard\keepn\sb120\sa120\b LIMITATION DES DOMMAGES-INT\'c9R\'caTS ET EXCLUSION DE RESPONSABILIT\'c9 POUR LES DOMMAGES.\b0 Vous pouvez obtenir de Sysinternals et de ses fournisseurs une indemnisation en cas de dommages directs uniquement \'e0 hauteur de 5,00 $ US. Vous ne pouvez pr\'e9tendre \'e0 aucune indemnisation pour les autres dommages, y compris les dommages sp\'e9ciaux, indirects ou accessoires et pertes de b\'e9n\'e9fices.\par" (Indicator: "sysinternals") "\pard\sb120\sa120 Elle s'applique \'e9galement, m\'eame si Sysinternals connaissait ou devrait conna\'eetre l'\'e9ventualit\'e9 d'un tel dommage. Si votre pays n'autorise pas l'exclusion ou la limitation de responsabilit\'e9 pour les dommages indirects, accessoires ou de quelque nature que ce soit, il se peut que la limitation ou l'exclusion ci-dessus ne s'appliquera pas \'e0 votre \'e9gard.\par" (Indicator: "sysinternals") "SYSINTERNALS SOFTWARE LICENSE TERMS These license terms are an agreement between Sysinternals(a wholly owned subsidiary of Microsoft Corporation) and you.Please read them.They apply to the software you are downloading from technet.microsoft.com / sysinternals, which includes the media on which you received it, if any.The terms also apply to any Sysinternals * updates, *supplements, *Internet - based services, *and support services for this software, unless other terms accompany those items.If so, those terms apply. BY USING THE SOFTWARE, YOU ACCEPT THESE TERMS.IF YOU DO NOT ACCEPT THEM, DO NOT USE THE SOFTWARE. If you comply with these license terms, you have the rights below. INSTALLATION AND USER RIGHTS You may install and use any number of copies of the software on your devices. SCOPE OF LICENSE The software is licensed, not sold.This agreement only gives you some rights to use the software.Sysinternals reserves all other rights.Unless applicable law gives you more rights despite this limit" (Indicator: "sysinternals") "information, files saved by Sysinternals tools may include personally identifiable or other sensitive information(such as usernames, passwords, paths to files accessed, and paths to registry accessed).By using this software, you acknowledge that you are aware of this and take sole responsibility for any personally identifiable or other sensitive information provided to Microsoft or any other party through your use of the software. DOCUMENTATION Any person that has valid access to your computer or internal network may copy and use the documentation for your internal, reference purposes. EXPORT RESTRICTIONS The software is subject to United States export laws and regulations.You must comply with all domestic and international export laws and regulations that apply to the software.These laws include restrictions on destinations, end users and end use.For additional information, see www.microsoft.com / exporting . SUPPORT SERVICES Because this software is "as is " we may not provide support services" (Indicator: "sysinternals") "permit it to do so. DISCLAIMER OF WARRANTY The software is licensed "as - is." You bear the risk of using it.Sysinternals gives no express warranties, guarantees or conditions.You may have additional consumer rights under your local laws which this agreement cannot change.To the extent permitted under your local laws, sysinternals excludes the implied warranties of merchantability, fitness for a particular purpose and non - infringement. LIMITATION ON AND EXCLUSION OF REMEDIES AND DAMAGES You can recover from sysinternals and its suppliers only direct damages up to U.S.$5.00.You cannot recover any other damages, including consequential, lost profits, special, indirect or incidental damages. This limitation applies to * anything related to the software, services, content(including code) on third party Internet sites, or third party programs; and * claims for breach of contract, breach of warranty, guarantee or condition, strict liability, negligence, or other tort to the extent permitted by applicab" (Indicator: "sysinternals") "le law. It also applies even if Sysinternals knew or should have known about the possibility of the damages.The above limitation or exclusion may not apply to you because your country may not allow the exclusion or limitation of incidental, consequential or other damages. Please note : As this software is distributed in Quebec, Canada, some of the clauses in this agreement are provided below in French. Remarque : Ce logiciel" (Indicator: "sysinternals") "ril.Sysinternals n'accorde aucune autre garantie expresse. Vous pouvez b" (Indicator: "sysinternals") "POUR LES DOMMAGES.Vous pouvez obtenir de Sysinternals et de ses fournisseurs une indemnisation en cas de dommages directs uniquement" (Indicator: "sysinternals") "me si Sysinternals connaissait ou devrait conna" (Indicator: "sysinternals") "http://www.sysinternals.com 0" (Indicator: "sysinternals") "Sysinternals License" (Indicator: "sysinternals") "Software\Sysinternals\%s" (Indicator: "sysinternals")28:T1dac,Assembly shows XOR instruction xor rax rsp in Stream UID: 30712-779-00000001400042B9 Assembly shows XOR instruction xor eax esp in Stream UID: 30712-779-00000001400042B9 Assembly shows XOR instruction xor rcx rsp in Stream UID: 30712-779-00000001400042B9 Assembly shows XOR instruction xor ecx esp in Stream UID: 30712-779-00000001400042B9 Assembly shows XOR instruction xor rax rsp in Stream UID: 30712-837-0000000140006990 Assembly shows XOR instruction xor eax esp in Stream UID: 30712-837-0000000140006990 Assembly shows XOR instruction xor rcx rsp in Stream UID: 30712-837-0000000140006990 Assembly shows XOR instruction xor ecx esp in Stream UID: 30712-837-0000000140006990 Assembly shows XOR instruction xor rcx rbp in Stream UID: 30712-1164-0000000140021A5F Assembly shows XOR instruction xor ecx ebp in Stream UID: 30712-1164-0000000140021A5F Assembly shows XOR instruction xor rax rsp in Stream UID: 30712-695-00000001400098F0 Assembly shows XOR instruction xor eax esp in Stream UID: 30712-695-00000001400098F0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 30712-695-00000001400098F0 Assembly shows XOR instruction xor ecx esp in Stream UID: 30712-695-00000001400098F0 Assembly shows XOR instruction xor rax rsp in Stream UID: 30712-691-0000000140009800 Assembly shows XOR instruction xor eax esp in Stream UID: 30712-691-0000000140009800 Assembly shows XOR instruction xor rcx rsp in Stream UID: 30712-691-0000000140009800 Assembly shows XOR instruction xor ecx esp in Stream UID: 30712-691-0000000140009800 Assembly shows XOR instruction xor rcx rsp in Stream UID: 30712-1189-00000001400231CC Assembly shows XOR instruction xor ecx esp in Stream UID: 30712-1189-00000001400231CC Assembly shows XOR instruction xor rax rsp in Stream UID: 30712-696-0000000140007570 Assembly shows XOR instruction xor eax esp in Stream UID: 30712-696-0000000140007570 Assembly shows XOR instruction xor rcx rsp in Stream UID: 30712-696-0000000140007570 Assembly shows XOR instruction xor ecx esp in Stream UID: 30712-696-0000000140007570 Assembly shows XOR instruction xor rcx rsp in Stream UID: 30712-885-000000014000A68B Assembly shows XOR instruction xor ecx esp in Stream UID: 30712-885-000000014000A68B Assembly shows XOR instruction xor rax rsp in Stream UID: 30712-692-00000001400099D0 Assembly shows XOR instruction xor eax esp in Stream UID: 30712-692-00000001400099D0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 30712-692-00000001400099D0 Assembly shows XOR instruction xor ecx esp in Stream UID: 30712-692-00000001400099D0 Assembly shows XOR instruction xor ecx eax in Stream UID: 30712-1067-000000014001AD30 Assembly shows XOR instruction xor rcx rsp in Stream UID: 30712-1067-000000014001AD30 Assembly shows XOR instruction xor ecx esp in Stream UID: 30712-1067-000000014001AD30 Assembly shows XOR instruction xor rax rsp in Stream UID: 30712-683-0000000140009670 Assembly shows XOR instruction xor eax esp in Stream UID: 30712-683-0000000140009670 Assembly shows XOR instruction xor rcx rsp in Stream UID: 30712-683-0000000140009670 Assembly shows XOR instruction xor ecx esp in Stream UID: 30712-683-0000000140009670 Assembly shows XOR instruction xor rax rsp in Stream UID: 30712-694-0000000140005870 Assembly shows XOR instruction xor eax esp in Stream UID: 30712-694-0000000140005870 Assembly shows XOR instruction xor rcx rsp in Stream UID: 30712-694-0000000140005870 Assembly shows XOR instruction xor ecx esp in Stream UID: 30712-694-0000000140005870 Assembly shows XOR instruction xor rax rsp in Stream UID: 30712-743-0000000140001559 Assembly shows XOR instruction xor eax esp in Stream UID: 30712-743-0000000140001559 Assembly shows XOR instruction xor rcx rsp in Stream UID: 30712-743-0000000140001559 Assembly shows XOR instruction xor ecx esp in Stream UID: 30712-743-0000000140001559 Assembly shows XOR instruction xor rax rsp in Stream UID: 30712-668-000000014000F890 Assembly shows XOR instruction xor eax esp in Stream UID: 30712-668-000000014000F890 Assembly shows XOR instruction xor rcx rsp in Stream UID: 30712-668-000000014000F890 Assembly shows XOR instruction xor ecx esp in Stream UID: 30712-668-000000014000F890 Assembly shows XOR instruction xor rcx rsp in Stream UID: 30712-836-0000000140006484 Assembly shows XOR instruction xor ecx esp in Stream UID: 30712-836-0000000140006484 Assembly shows XOR instruction xor rcx rsp in Stream UID: 30712-742-00000001400012C5 Assembly shows XOR instruction xor ecx esp in Stream UID: 30712-742-00000001400012C5 Assembly shows XOR instruction xor rcx rsp in Stream UID: 30712-777-0000000140003805 Assembly shows XOR instruction xor ecx esp in Stream UID: 30712-777-0000000140003805 Assembly shows XOR instruction xor rax rsp in Stream UID: 30712-689-0000000140008130 Assembly shows XOR instruction xor eax esp in Stream UID: 30712-689-0000000140008130 Assembly shows XOR instruction xor rcx rsp in Stream UID: 30712-689-0000000140008130 Assembly shows XOR instruction xor ecx esp in Stream UID: 30712-689-0000000140008130 Assembly shows XOR instruction xor rax rsp in Stream UID: 30712-723-00000001400029B0 Assembly shows XOR instruction xor eax esp in Stream UID: 30712-723-00000001400029B0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 30712-723-00000001400029B0 Assembly shows XOR instruction xor ecx esp in Stream UID: 30712-723-00000001400029B0 Assembly shows XOR instruction xor rax rsp in Stream UID: 30712-690-000000014000A9A0 Assembly shows XOR instruction xor eax esp in Stream UID: 30712-690-000000014000A9A0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 30712-690-000000014000A9A0 Assembly shows XOR instruction xor ecx esp in Stream UID: 30712-690-000000014000A9A0 Assembly shows XOR instruction xor rax rsp in Stream UID: 30712-688-0000000140006D40 Assembly shows XOR instruction xor eax esp in Stream UID: 30712-688-0000000140006D40 Assembly shows XOR instruction xor rcx rsp in Stream UID: 30712-688-0000000140006D40 Assembly shows XOR instruction xor ecx esp in Stream UID: 30712-688-0000000140006D40 Assembly shows XOR instruction xor qword ptr [rbp+10h] rax in Stream UID: 30712-1401-000000014001E9D6 Assembly shows XOR instruction xor dword ptr [rbp+10h] eax in Stream UID: 30712-1401-000000014001E9D6 Assembly shows XOR instruction xor rax qword ptr [rbp+20h] in Stream UID: 30712-1401-000000014001E9D6 Assembly shows XOR instruction xor eax dword ptr [rbp+20h] in Stream UID: 30712-1401-000000014001E9D6 Assembly shows XOR instruction xor rax qword ptr [rbp+10h] in Stream UID: 30712-1401-000000014001E9D6 Assembly shows XOR instruction xor eax dword ptr [rbp+10h] in Stream UID: 30712-1401-000000014001E9D6 Assembly shows XOR instruction xor rax rcx in Stream UID: 30712-1401-000000014001E9D6 Assembly shows XOR instruction xor eax ecx in Stream UID: 30712-1401-000000014001E9D6 Assembly shows XOR instruction xor rax rsp in Stream UID: 30712-745-0000000140001160 Assembly shows XOR instruction xor eax esp in Stream UID: 30712-745-0000000140001160 Assembly shows XOR instruction xor rcx rbp in Stream UID: 30712-1064-000000014001A527 Assembly shows XOR instruction xor ecx ebp in Stream UID: 30712-1064-000000014001A527 Assembly shows XOR instruction xor ecx eax in Stream UID: 30712-1077-000000014001BED6 Assembly shows XOR instruction xor rcx rsp in Stream UID: 30712-1077-000000014001BED6 Assembly shows XOR instruction xor ecx esp in Stream UID: 30712-1077-000000014001BED629:T42a,Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "ProcDump_benign.bin") Found reference to API "NtQuerySystemInformation" (Indicator: "QuerySystemInformation"; File: "ProcDump_benign.bin") Found reference to API "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStrings"; File: "ProcDump_benign.bin") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; File: "ProcDump_benign.bin") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "QuerySystemInformation"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp")2a:T636,Found reference to API "GetVersionFromProcess" (Indicator: "GetVersion"; File: "ProcDump_benign.bin") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "ProcDump_benign.bin") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "ProcDump_benign.bin") Found reference to API "ICLRRuntimeInfo->GetVersionString - Error %x" (Indicator: "GetVersion"; File: "ProcDump_benign.bin") Found reference to API "GetVersionFromProcess - Error %x (E_INVALIDARG) - CLR Not Loaded" (Indicator: "GetVersion"; File: "ProcDump_benign.bin") Found reference to API "GetVersionFromProcess - Error %x" (Indicator: "GetVersion"; File: "ProcDump_benign.bin") Found reference to API "ICLRRuntimeInfo->GetVersionString - Error %x" (Indicator: "GetVersion"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API "GetVersionFromProcess - Error %x (E_INVALIDARG) - CLR Not Loaded" (Indicator: "GetVersion"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API "GetVersionFromProcess - Error %x" (Indicator: "GetVersion"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API "GetVersionFromProcess" (Indicator: "GetVersion"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp")2b:T9913,Found reference to API (Indicator: "FlsAlloc"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "FlsFree"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "FlsGetValue"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "FlsSetValue"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "CreateEventExW"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "CreateSemaphoreExW"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "SetThreadStackGuarantee"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "CreateThreadpoolTimer"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "SetThreadpoolTimer"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "CloseThreadpoolTimer"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "CreateThreadpoolWait"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "SetThreadpoolWait"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "CloseThreadpoolWait"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "FlushProcessWriteBuffers"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "FreeLibraryWhenCallbackReturns"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "GetCurrentProcessorNumber"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "GetLogicalProcessorInformation"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "CreateSymbolicLinkW"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "SetDefaultDllDirectories"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "EnumSystemLocalesEx"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "CompareStringEx"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "GetDateFormatEx"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "GetLocaleInfoEx"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "GetTimeFormatEx"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "GetUserDefaultLocaleName"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "IsValidLocaleName"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "LCMapStringEx"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "GetTickCount64"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "MessageBoxW"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "GetActiveWindow"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "GetLastActivePopup"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "GetUserObjectInformationW"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "GetProcessWindowStation"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "CreateFile2"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "CommandLineToArgvW"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "GetProcessMemoryInfo"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "NtQuerySystemInformation"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "RtlGetLastNtStatus"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "IsWow64Process"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "GetPackageFullName"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "NtResumeProcess"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "RtlCreateProcessReflection"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "EnumProcessModules"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "CreateEventW"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "GetCommandLineW"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "GetModuleHandleW"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "LoadLibraryW"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "GetProcAddress"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "LocalAlloc"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "LocalFree"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "GetVersionExW"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "GetModuleFileNameW"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "SetEvent"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "LeaveCriticalSection"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "EnterCriticalSection"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "CloseHandle"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "WaitForSingleObject"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "Sleep"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "DeleteCriticalSection"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "GetThreadContext"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "GetTickCount"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "ReadProcessMemory"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "OpenThread"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "DebugActiveProcess"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "DebugActiveProcessStop"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "CreateProcessW"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "GetCurrentProcess"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "InitializeCriticalSection"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "OpenProcess"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "GetLastError"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "ContinueDebugEvent"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "WaitForDebugEvent"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "ResumeThread"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "CreateThread"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "FormatMessageW"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "MultiByteToWideChar"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "TerminateProcess"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "GetFullPathNameW"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "GetFileAttributesW"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "GetEnvironmentVariableA"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "Process32FirstW"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "GetSystemInfo"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "Process32NextW"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "IsDebuggerPresent"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "DebugBreak"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "GetSystemTime"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "ExitProcess"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "GetDateFormatW"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "FreeLibrary"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "SetFilePointerEx"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "GetTimeFormatW"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "CreateFileW"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "ReleaseSemaphore"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "GetFileSizeEx"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "CreateSemaphoreW"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "GetProcessId"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "DeleteFileW"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "SetLastError"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "DeviceIoControl"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "VirtualQueryEx"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "SetWindowTextW"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "GetSysColorBrush"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "InflateRect"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "LoadCursorW"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "SetCursor"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "LoadStringA"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "GetWindowThreadProcessId"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "IsWindowVisible"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "EnumWindows"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "wsprintfW"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "SetMapMode"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "GetDeviceCaps"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "RegCreateKeyW"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "RegQueryValueExW"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "RegCloseKey"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "RegSetValueExW"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "RegCreateKeyExW"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "RegDeleteKeyW"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "RegDeleteValueW"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "RegOpenKeyExW"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "OpenProcessToken"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "LookupPrivilegeValueW"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "CloseServiceHandle"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "OpenSCManagerW"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "EnumServicesStatusExW"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "CoUninitialize"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "CoInitializeEx"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "CoCreateInstance"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "CLSIDFromString"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "HeapFree"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "HeapAlloc"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "GetConsoleMode"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "ReadConsoleInputA"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "SetConsoleMode"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "EncodePointer"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "DecodePointer"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "RtlPcToFileHeader"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "RaiseException"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "IsValidCodePage"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "GetACP"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "GetOEMCP"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "GetCPInfo"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "GetCurrentThreadId"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "GetProcessHeap"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "GetModuleHandleExW"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "WideCharToMultiByte"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "GetStdHandle"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "WriteFile"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "RtlCaptureContext"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "TlsAlloc"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "TlsGetValue"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "TlsSetValue"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "TlsFree"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "GetStartupInfoW"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "HeapSize"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "GetStringTypeW"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "FlushFileBuffers"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "GetConsoleCP"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "GetFileType"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "GetCurrentProcessId"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "LCMapStringW"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "LoadLibraryExW"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "OutputDebugStringW"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "WriteConsoleW"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "HeapReAlloc"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "SetStdHandle"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "ReadFile"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "ReadConsoleW"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "SetEndOfFile"; File: "ProcDump_benign.bin") Found reference to API (Indicator: "Beep"; Source: "00000000-00005436.00000000.68657.02210000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "CreateEventExW"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "SetThreadStackGuarantee"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWait"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolWait"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWait"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "FlushProcessWriteBuffers"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "FreeLibraryWhenCallbackReturns"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessorNumber"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "GetLogicalProcessorInformation"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "CreateSymbolicLinkW"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "SetDefaultDllDirectories"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesEx"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatEx"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatEx"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "IsValidLocaleName"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "GetUserObjectInformationW"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "CreateFile2"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "CommandLineToArgvW"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "GetProcessMemoryInfo"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "NtQuerySystemInformation"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "RtlGetLastNtStatus"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "GetPackageFullName"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "NtResumeProcess"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "RtlCreateProcessReflection"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "EnumProcessModules"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "GetThreadContext"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "ReadProcessMemory"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "OpenThread"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "DebugActiveProcess"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "DebugActiveProcessStop"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "ContinueDebugEvent"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "WaitForDebugEvent"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleCtrlHandler"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableA"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "Process32FirstW"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "Process32NextW"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "DebugBreak"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTime"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatW"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatW"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreW"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "GetProcessId"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "DeviceIoControl"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "VirtualQueryEx"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextW"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "GetSysColorBrush"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "InflateRect"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "LoadCursorW"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "SetCursor"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "IsWindowVisible"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "EnumWindows"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "wsprintfW"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "SetMapMode"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyW"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyW"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "OpenSCManagerW"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "EnumServicesStatusExW"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "CLSIDFromString"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleInputA"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleMode"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "RtlPcToFileHeader"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp")2c:T6a6,Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "ProcDump_benign.bin") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "ProcDump_benign.bin") Found reference to API "ICorDebugManagedCallback::CreateThread" (Indicator: "CreateThread"; File: "ProcDump_benign.bin") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "ProcDump_benign.bin") Found reference to API "OpenThread" (Indicator: "OpenThread"; File: "ProcDump_benign.bin") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "ProcDump_benign.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "ProcDump_benign.bin") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API "ICorDebugManagedCallback::CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp")2d:T777,".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CONHOST.EXE"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\BAM"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "")2e:Tc0b,".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "PROCDUMP_BENIGN"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "")2f:T449,".exe" trying to touch file "C:\Windows\System32\apphelp.dll" ".exe" trying to touch file "C:\ProcDump_benign.exe" ".exe" trying to touch file "C:\Windows\System32\ntdll.dll" ".exe" trying to touch file "C:\Windows\System32\kernel32.dll" ".exe" trying to touch file "C:\Windows\System32\KernelBase.dll" ".exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" ".exe" trying to touch file "\Device\HarddiskVolume2\PROCDUMP_BENIGN.EXE.LOCAL" ".exe" trying to touch file "C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.16299.248_none_8879e63c4abacc42\comctl32.dll" ".exe" trying to touch file "\Device\HarddiskVolume2\PDH.DLL" ".exe" trying to touch file "C:\Windows\System32\pdh.dll" ".exe" trying to touch file "C:\Windows\System32\psapi.dll" ".exe" trying to touch file "C:\Windows\System32\win32u.dll" ".exe" trying to touch file "C:\Windows\System32\ucrtbase.dll"30:Tad8,Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; File: "ProcDump_benign.bin") Found reference to API "SymEnumProcesses" (Indicator: "EnumProcesses"; File: "ProcDump_benign.bin") Found reference to API "EnumProcessModules" (Indicator: "EnumProcessModules"; File: "ProcDump_benign.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "ProcDump_benign.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "ProcDump_benign.bin") Found reference to API "Process32FirstW" (Indicator: "Process32First"; File: "ProcDump_benign.bin") Found reference to API "Process32NextW" (Indicator: "Process32Next"; File: "ProcDump_benign.bin") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "ProcDump_benign.bin") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "ProcDump_benign.bin") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "ProcDump_benign.bin") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "ProcDump_benign.bin") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API "SymEnumProcesses" (Indicator: "EnumProcesses"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API "EnumProcessModules" (Indicator: "EnumProcessModules"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp")31:T408,Found reference to API "GetFileInformationByHandleExW" (Indicator: "GetFileInformationByHandle"; File: "ProcDump_benign.bin") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "ProcDump_benign.bin") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "ProcDump_benign.bin") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "ProcDump_benign.bin") Found reference to API "GetFileInformationByHandleExW" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp")32:T434,Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "ProcDump_benign.bin") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "ProcDump_benign.bin") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "ProcDump_benign.bin") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "ProcDump_benign.bin") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00005436.00000000.68657.031A9000.00000002.mdmp")33:Tae6,".exe" wrote bytes "80bb9d87f97f0000" to virtual address "0x76A05000" (part of module "TEXTINPUTFRAMEWORK.DLL") ".exe" wrote bytes "c02b9776f97f0000d0b29976f97f000030109876f97f0000" to virtual address "0x850A1048" (part of module "MSCTF.DLL") ".exe" wrote bytes "107cda83f97f0000e0c3d983f97f000020e7d783f97f000060cad783f97f00003027dd83f97f00007054da83f97f00008017dd83f97f000040c9d783f97f000080cfd783f97f0000004bd783f97f0000008bda83f97f0000" to virtual address "0x873D4338" (part of module "GDI32.DLL") ".exe" wrote bytes "009cdd83f97f0000200cd883f97f000040ffdc83f97f0000b0fadc83f97f0000" to virtual address "0x873D4098" (part of module "GDI32.DLL") ".exe" wrote bytes "90c48186f97f0000e0bc8186f97f0000e0bf8186f97f0000" to virtual address "0x877780F0" (part of module "COMBASE.DLL") ".exe" wrote bytes "e03b5682f97f0000302a5682f97f0000e0215682f97f0000e01e5682f97f0000c0355682f97f0000b0155682f97f0000c0265782f97f0000c0145682f97f0000" to virtual address "0x823810F0" (part of module "UXTHEME.DLL") ".exe" wrote bytes "b05f4b81f97f0000c0d94781f97f0000b0574b81f97f0000e0564b81f97f000040574b81f97f0000" to virtual address "0x850A1000" (part of module "MSCTF.DLL") ".exe" wrote bytes "90eb3f87f97f0000" to virtual address "0x73EB9360" (part of module "COMCTL32.DLL") ".exe" wrote bytes "f0c0d983f97f000030eadc83f97f0000303fd783f97f00001024dd83f97f00009080d783f97f0000c04bd783f97f00008024dd83f97f00006072da83f97f000030f2d783f97f00008005d983f97f0000" to virtual address "0x873D4270" (part of module "GDI32.DLL") ".exe" wrote bytes "30c0da83f97f000020c0da83f97f000000b8da83f97f0000c09ed983f97f0000d0a1d983f97f000090bad983f97f000080badf83f97f000080a2da83f97f0000603dd783f97f00004023de83f97f0000" to virtual address "0x873D52B0" (part of module "GDI32.DLL") ".exe" wrote bytes "202ed283f97f0000302ed283f97f0000" to virtual address "0x87778378" (part of module "COMBASE.DLL") ".exe" wrote bytes "f0e55587f97f0000a0ff5587f97f0000" to virtual address "0x870761C8" (part of module "IMM32.DLL") ".exe" wrote bytes "b0011784f97f0000" to virtual address "0x867E71A8" (part of module "RPCRT4.DLL") ".exe" wrote bytes "c01cf984f97f0000" to virtual address "0x76A05078" (part of module "TEXTINPUTFRAMEWORK.DLL") ".exe" wrote bytes "6012d883f97f0000" to virtual address "0x873D4020" (part of module "GDI32.DLL") ".exe" wrote bytes "00b2d983f97f0000207ad983f97f0000b0b0d983f97f0000" to virtual address "0x873D4000" (part of module "GDI32.DLL") ".exe" wrote bytes "b01379d1a7010000801479d1a7010000" to virtual address "0x877781C8" (part of module "COMBASE.DLL")34:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"f4c8369e4de1f12cc5a71eb5586b38fc78a9d8db2b189b8c25ef17a572d4d6b7","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"clean","threat_score":0,"unified_at_epoch_ms":1791402715835,"unified_at":"2026-10-07T19:51:55.835Z","metadata":{"hashes":{"sha256":"f4c8369e4de1f12cc5a71eb5586b38fc78a9d8db2b189b8c25ef17a572d4d6b7","sha1":"39ae8ba8c5280a09ba638df4c9d64ac0f3f706b6","md5":"45a1ac6973b95ecfd20bc18f35a68f18","sha512":"a3dd9799a321a3d4f1eb99d4ce9ad2c47fae0e67415ebd4c727e184ee55b9ebb895f6e8f045edaaf0d3a08a32359b57e6c0f3821c98bea0e3563382788dad6fe","ssdeep":"6144:vEzEWQwlMQUAWiiuTOBo46XSuwPMDOw0w1t7s3kms15q:vEzn5MoW/8SM/zq","ssdeep_chunks":["6144:vEzEWQw","6144:EzEWQwl","6144:zEWQwlM","6144:EWQwlMQ","6144:WQwlMQU","6144:QwlMQUA","6144:wlMQUAW","6144:lMQUAWi","6144:MQUAWii","6144:QUAWiiu","6144:UAWiiuT","6144:AWiiuTO","6144:WiiuTOB","6144:iiuTOBo","6144:iuTOBo4","6144:uTOBo46","6144:TOBo46X","6144:OBo46XS","6144:Bo46XSu","6144:o46XSuw","6144:46XSuwP","6144:6XSuwPM","6144:XSuwPMD","6144:SuwPMDO","6144:uwPMDOw","6144:wPMDOw0","6144:PMDOw0w","6144:MDOw0w1","6144:DOw0w1t","6144:Ow0w1t7","6144:w0w1t7s","6144:0w1t7s3","6144:w1t7s3k","6144:1t7s3km","6144:t7s3kms","6144:7s3kms1","6144:s3kms15","6144:3kms15q","12288:vEzEWQw","12288:EzEWQwl","12288:zEWQwlM","12288:EWQwlMQ","12288:WQwlMQU","12288:QwlMQUA","12288:wlMQUAW","12288:lMQUAWi","12288:MQUAWii","12288:QUAWiiu","12288:UAWiiuT","12288:AWiiuTO","12288:WiiuTOB","12288:iiuTOBo","12288:iuTOBo4","12288:uTOBo46","12288:TOBo46X","12288:OBo46XS","12288:Bo46XSu","12288:o46XSuw","12288:46XSuwP","12288:6XSuwPM","12288:XSuwPMD","12288:SuwPMDO","12288:uwPMDOw","12288:wPMDOw0","12288:PMDOw0w","12288:MDOw0w1","12288:DOw0w1t","12288:Ow0w1t7","12288:w0w1t7s","12288:0w1t7s3","12288:w1t7s3k","12288:1t7s3km","12288:t7s3kms","12288:7s3kms1","12288:s3kms15","12288:3kms15q","6144:vEzn5Mo","6144:Ezn5MoW","6144:zn5MoW/","6144:n5MoW/8","6144:5MoW/8S","6144:MoW/8SM","6144:oW/8SM/","6144:W/8SM/z","6144:/8SM/zq"],"imphash":"0ad501347658d973b4e2cfc18237277b"},"file_info":{"file_name":"F4C8369E4DE1F12CC5A71EB5586B38FC78A9D8DB2B189B8C25EF17A572D4D6B7","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":310440,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1667183867000,"last_seen":1720202328000,"last_multi_scan":1720202328000}},"detections":{"summary":{"verdict":"clean","score":0,"tags":["ausiv","autorun","chir","crypt","cryptinject","downloader","expiro","floxif","generik","hacktool","metasploit","meterpreter","mofksys","neshta","parite","rozena","sality","swrort","zpevdo"]},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":49},"sandbox_signatures":{"informative_count":110,"suspicious_count":21,"malicious_count":2,"total":133},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"whitelisted","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"suspicious","value":"Contains ability to modify processes thread functionality"},{"type":"suspicious","value":"Contains ability to retrieve the command-line string for the current process"},{"type":"suspicious","value":"Contains ability to retrieve the fully qualified path of module"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"635f33b171ff3f101e0c4356"},{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","sources":[{"report_type":"sandbox","report_id":"635f33b171ff3f101e0c4356"},{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to enable or disable privileges in the specified access token (API string)"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"635f33b171ff3f101e0c4356"},{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"635f33b171ff3f101e0c4356"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","identifiers":[{"type":"suspicious","value":"Contains ability to adjust token privileges"}],"sources":[{"report_type":"sandbox","report_id":"635f33b171ff3f101e0c4356"},{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"malicious","value":"The input sample contains a known anti-VM trick"},{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"}],"sources":[{"report_type":"sandbox","report_id":"635f33b171ff3f101e0c4356"},{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"},{"type":"informative","value":"The input sample is signed with a valid certificate"}],"sources":[{"report_type":"sandbox","report_id":"635f33b171ff3f101e0c4356"},{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Imports GetEnvironmentVariable API"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"suspicious","value":"Contains ability to retrieve information about the current system"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"suspicious","value":"Contains ability to check if a debugger is running"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to query the machine version"}],"sources":[{"report_type":"sandbox","report_id":"635f33b171ff3f101e0c4356"},{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Reads information about supported languages"},{"type":"informative","value":"Contains registry location strings"},{"type":"suspicious","value":"Read windows product name from registry"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains ability to query registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"635f33b171ff3f101e0c4356"},{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Contains ability to query local/system time"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"635f33b171ff3f101e0c4356"},{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Contains ability to enumerate processes (API string)"},{"type":"suspicious","value":"Contains ability to enumerate processes/modules/threads"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"635f33b171ff3f101e0c4356"},{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"}],"sources":[{"report_type":"sandbox","report_id":"635f33b171ff3f101e0c4356"},{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"}],"sources":[{"report_type":"sandbox","report_id":"635f33b171ff3f101e0c4356"},{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","sources":[{"report_type":"sandbox","report_id":"635f33b171ff3f101e0c4356"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"635f33b171ff3f101e0c4356"},{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads rich edit control libraries"}],"sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"suspicious","value":"Contains ability to modify thread functionality - possible hijack (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","identifiers":[{"type":"suspicious","value":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to delete registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve default language settings"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"suspicious","value":"Contains ability to enumerate services"},{"type":"informative","value":"Queries services related registry keys"},{"type":"informative","value":"Contains the ability to enumerate service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query system locale (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"suspicious","value":"YARA signature match - Sysinternal Tool"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains reference to Sysinternals URL"}],"sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003816-32010-15-3F7BA034","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"635f33b171ff3f101e0c4356"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 25823-1401-000000014001E9D6\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00003816-32010-1375-3F7BE9D6","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"635f33b171ff3f101e0c4356"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 25823-1401-000000014001E9D6\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00003816-32010-1375-3F7BE9D6\n GetSystemTime@KERNEL32.DLL at 00000000-00003816-32010-203-3F7AAB60\n GetSystemTime@KERNEL32.DLL at 00000000-00003816-32010-97-3F7B0020\n GetSystemTime@KERNEL32.DLL at 00000000-00003816-32010-124-3F7AE880","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"635f33b171ff3f101e0c4356"},{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.DLL at 00000000-00003816-32010-201-3F7A1E40","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"635f33b171ff3f101e0c4356"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"635f33b171ff3f101e0c4356"},{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetVersionExW@KERNEL32.DLL directly followed by \"cmp dword ptr [rsp+74h], 06h\" and \"jnc 3F7A2319h\" at 00000000-00003816-32010-201-3F7A1E40","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"635f33b171ff3f101e0c4356"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.DLL at 00000000-00003816-32010-147-3F7C55F4\n GetProcessHeap@KERNEL32.DLL at 00000000-00003816-32010-267-3F7B7FE4","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"635f33b171ff3f101e0c4356"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/70 Antivirus vendors marked sample as malicious (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"635f33b171ff3f101e0c4356"},{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\Builds\\13810\\Tools\\ProcDump_master\\bin\\x64\\Release\\procdump64.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"635f33b171ff3f101e0c4356"},{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@KERNEL32.dll at 25823-683-0000000140009670\n Sleep@KERNEL32.dll at 25823-668-000000014000F890\n Sleep@KERNEL32.dll at 25823-786-0000000140004D1A\n Sleep@KERNEL32.dll at 25823-696-0000000140007570\n Sleep@KERNEL32.dll at 25823-784-0000000140004B45\n Sleep@KERNEL32.dll at 25823-885-000000014000A68B\n Sleep@KERNEL32.DLL at 00000000-00003816-32010-820-3F7AA68B\n Sleep@KERNEL32.DLL at 00000000-00003816-32010-299-3F7AF890\n Sleep@KERNEL32.DLL at 00000000-00003816-32010-76-3F7A9C10\n Sleep@KERNEL32.DLL at 00000000-00003816-32010-327-3F7A7570\n Sleep@KERNEL32.DLL at 00000000-00003816-32010-709-3F7A4B45\n Sleep@KERNEL32.DLL at 00000000-00003816-32010-314-3F7A9670\n Sleep@KERNEL32.DLL at 00000000-00003816-32010-711-3F7A4D1A\n Sleep@KERNEL32.DLL at 00000000-00003816-32010-32-3F7BA00C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"635f33b171ff3f101e0c4356"},{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryW@KERNEL32.dll at 25823-723-00000001400029B0\n LoadLibraryW@KERNEL32.dll at 25823-696-0000000140007570\n LoadLibraryW@KERNEL32.dll at 25823-688-0000000140006D40\n LoadLibraryExW@KERNEL32.DLL at 00000000-00003816-32010-62-3F7C20EC\n LoadLibraryW@KERNEL32.DLL at 00000000-00003816-32010-191-3F7AD800\n LoadLibraryW@KERNEL32.DLL at 00000000-00003816-32010-327-3F7A7570\n LoadLibraryW@KERNEL32.DLL at 00000000-00003816-32010-217-3F7A1C00\n LoadLibraryW@KERNEL32.DLL at 00000000-00003816-32010-196-3F7AD880\n LoadLibraryW@KERNEL32.DLL at 00000000-00003816-32010-355-3F7A29B0\n LoadLibraryW@KERNEL32.DLL at 00000000-00003816-32010-204-3F7ABAF0\n LoadLibraryW@KERNEL32.DLL at 00000000-00003816-32010-96-3F7A88B0\n LoadLibraryW@KERNEL32.DLL at 00000000-00003816-32010-218-3F7A1730\n LoadLibraryW@KERNEL32.DLL at 00000000-00003816-32010-319-3F7A6D40","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"635f33b171ff3f101e0c4356"},{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$25","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"635f33b171ff3f101e0c4356"},{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"General","name":"Found API related strings","description":"\"too many files open\" (Indicator: \"open\")\n \"connection_already_in_progress\" (Indicator: \"connect\")\n \"connection_aborted\" (Indicator: \"connect\")\n \"connection_refused\" (Indicator: \"connect\")\n \"connection_reset\" (Indicator: \"connect\")\n \"already_connected\" (Indicator: \"connect\")\n \"too_many_files_open\" (Indicator: \"open\")\n \"not_connected\" (Indicator: \"connect\")\n \"not_a_socket\" (Indicator: \"socket\")\n \"already connected\" (Indicator: \"connect\")\n \"connection aborted\" (Indicator: \"connect\")\n \"connection already in progress\" (Indicator: \"connect\")\n \"connection refused\" (Indicator: \"connect\")\n \"connection reset\" (Indicator: \"connect\")\n \"not a socket\" (Indicator: \"socket\")\n \"not connected\" (Indicator: \"connect\")\n \"too many files open in system\" (Indicator: \"open\")\n \"CorExitProcess\" (Indicator: \"ExitProcess\")\n \"FlsGetValue\" (Indicator: \"FlsGetValue\")\n \"FlsSetValue\" (Indicator: \"FlsSetValue\")","origin":"File/Memory","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"635f33b171ff3f101e0c4356"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\".exe\" loaded module \"%WINDIR%\\System32\\riched32.dll\" at F6300000\n \".exe\" loaded module \"%WINDIR%\\System32\\riched20.dll\" at F37A0000","origin":"Loaded Module","id":"module-2","sources":[{"report_type":"sandbox","report_id":"635f33b171ff3f101e0c4356"},{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"f4c8369e4de1f12cc5a71eb5586b38fc78a9d8db2b189b8c25ef17a572d4d6b7.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"635f33b171ff3f101e0c4356"},{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"f4c8369e4de1f12cc5a71eb5586b38fc78a9d8db2b189b8c25ef17a572d4d6b7.bin\" has an writable section named \".data\"","origin":"Static Parser","relevance":1,"id":"static-95","sources":[{"report_type":"sandbox","report_id":"635f33b171ff3f101e0c4356"},{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"f4c8369e4de1f12cc5a71eb5586b38fc78a9d8db2b189b8c25ef17a572d4d6b7.bin\" file has an entrypoint instructions - \"subrsp, 0x28,call0x14001e9b0,addrsp, 0x28,jmp0x140014150,int3,int3,subrsp, 0x28,movrcx, qword ptr [rip + 0x33c45],callqword ptr [rip + 0x150af],testrax, rax,je0x140014328,callrax,movedx, 1,xorecx, ecx,call0x14001eb50,call0x14001eb6c,int3,int3,int3,int3,int3,int3,int3,int3,int3,int3,int3,int3,int3,nopword ptr [rax + rax],movr11, rcx,movr10, rdx,cmpr8, 0x10,jbe0x140014419,\"","origin":"Static Parser","relevance":1,"id":"static-96","sources":[{"report_type":"sandbox","report_id":"635f33b171ff3f101e0c4356"},{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=Microsoft Time-Stamp PCA, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US\" (SHA1: A0:BE:CD:F3:6E:A6:31:96:63:F5:08:19:8E:0E:6F:C2:50:AD:48:49; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Microsoft Code Signing PCA, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US\" (SHA1: 3B:DA:32:3E:55:2D:B1:FD:E5:F4:FB:EE:75:D6:D5:B2:B1:87:EE:DC; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Microsoft Root Certificate Authority, DC=microsoft, DC=com\" (SHA1: 3C:AF:9B:A2:DB:55:70:CA:F7:69:42:FF:99:10:1B:99:38:88:E2:57; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Microsoft Root Certificate Authority, DC=microsoft, DC=com\" (SHA1: 37:5F:CB:82:5C:3D:C3:75:2A:02:E3:4E:B7:09:93:B4:99:71:91:EF; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"635f33b171ff3f101e0c4356"},{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"635f33b171ff3f101e0c4356"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$26","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"635f33b171ff3f101e0c4356"},{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\".exe\" called \"CreateCompatibleBitmap\" (UID: 00000000-00003816)","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"635f33b171ff3f101e0c4356"},{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes (API string)","description":"Observed api string:\"Process32FirstW\" [Source: f4c8369e4de1f12cc5a71eb5586b38fc78a9d8db2b189b8c25ef17a572d4d6b7.bin]\n Observed api string:\"Process32NextW\" [Source: f4c8369e4de1f12cc5a71eb5586b38fc78a9d8db2b189b8c25ef17a572d4d6b7.bin]\n Observed api string:\"CreateToolhelp32Snapshot\" [Source: f4c8369e4de1f12cc5a71eb5586b38fc78a9d8db2b189b8c25ef17a572d4d6b7.bin]","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"635f33b171ff3f101e0c4356"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Observed api string:\"GetEnvironmentVariableA\" [Source: f4c8369e4de1f12cc5a71eb5586b38fc78a9d8db2b189b8c25ef17a572d4d6b7.bin]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"635f33b171ff3f101e0c4356"},{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetEnvironmentVariable API","description":"Observed import api \"GetEnvironmentVariable\" which can \"read the host's architecture\" [Source: f4c8369e4de1f12cc5a71eb5586b38fc78a9d8db2b189b8c25ef17a572d4d6b7.bin]","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-81","sources":[{"report_type":"sandbox","report_id":"635f33b171ff3f101e0c4356"}]},{"level":"informative","category":"System Security","name":"Contains ability to enable or disable privileges in the specified access token (API string)","description":"Observed api string:\"AdjustTokenPrivileges\" [Source: f4c8369e4de1f12cc5a71eb5586b38fc78a9d8db2b189b8c25ef17a572d4d6b7.bin]","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"635f33b171ff3f101e0c4356"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Observed api string:\"SeDebugPrivilege which can Debug programs\"[Source: f4c8369e4de1f12cc5a71eb5586b38fc78a9d8db2b189b8c25ef17a572d4d6b7.bin]","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"635f33b171ff3f101e0c4356"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"635f33b171ff3f101e0c4356"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Contains ability to check if a debugger is running","description":"IsDebuggerPresent@KERNEL32.DLL at 00000000-00003816-32010-62-3F7C20EC\n IsDebuggerPresent@KERNEL32.DLL at 00000000-00003816-32010-177-3F7AB580\n IsDebuggerPresent@KERNEL32.DLL at 00000000-00003816-32010-13-3F7B24C8\n IsDebuggerPresent@KERNEL32.DLL at 00000000-00003816-32010-94-3F7AACA0\n IsDebuggerPresent@KERNEL32.DLL at 00000000-00003816-32010-11-3F7B52E0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":3,"id":"stream-75","sources":[{"report_type":"sandbox","report_id":"635f33b171ff3f101e0c4356"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Looks up many procedures within the same disassembly stream (often used to hide usage)","description":"Found 33 calls to GetProcAddress@KERNEL32.DLL at 00000000-00003816-32010-260-3F7B8188\n Found 11 calls to GetProcAddress@KERNEL32.DLL at 00000000-00003816-32010-194-3F7A5520","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-40","sources":[{"report_type":"sandbox","report_id":"635f33b171ff3f101e0c4356"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"$27","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"635f33b171ff3f101e0c4356"},{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"suspicious","category":"General","name":"PE file has a high image base","description":"\"f4c8369e4de1f12cc5a71eb5586b38fc78a9d8db2b189b8c25ef17a572d4d6b7.bin\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":5,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"635f33b171ff3f101e0c4356"},{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\".exe\" read file \"%WINDIR%\\win.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"635f33b171ff3f101e0c4356"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to adjust token privileges","description":"LookupPrivilegeValueW@ADVAPI32.dll at 25823-689-0000000140008130","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1134.003","relevance":5,"id":"stream-76","sources":[{"report_type":"sandbox","report_id":"635f33b171ff3f101e0c4356"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCreateKeyExW\n RegDeleteValueW\n RegCloseKey\n OpenProcessToken\n RegOpenKeyExW\n RegCreateKeyW\n RegOpenKeyW\n RegDeleteKeyW\n GetFileAttributesW\n GetThreadContext\n WriteFile\n OutputDebugStringW\n DeviceIoControl\n GetModuleFileNameW\n IsDebuggerPresent\n UnhandledExceptionFilter\n LoadLibraryExW\n CreateThread\n TerminateProcess\n GetModuleHandleExW\n CreateToolhelp32Snapshot\n LoadLibraryW\n GetVersionExW\n GetTickCount\n OpenProcess\n GetStartupInfoW\n ReadProcessMemory\n DeleteFileW\n GetProcAddress\n GetFileSizeEx\n CreateFileW\n GetSystemInfo\n Process32NextW\n GetCommandLineW\n Process32FirstW\n GetModuleHandleW\n CreateProcessW\n Sleep\n GetWindowThreadProcessId","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"635f33b171ff3f101e0c4356"},{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"635f33b171ff3f101e0c4356"},{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"malicious","category":"Environment Awareness","name":"The input sample contains a known anti-VM trick","description":"Found VM detection artifact \"CPUID trick\" in \"f4c8369e4de1f12cc5a71eb5586b38fc78a9d8db2b189b8c25ef17a572d4d6b7.bin\" (Offset: 101635)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-8","sources":[{"report_type":"sandbox","report_id":"635f33b171ff3f101e0c4356"},{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"malicious","category":"General","name":"Contains ability to start/interact with device drivers","description":"DeviceIoControl@KERNEL32.DLL at 00000000-00003816-32010-97-3F7B0020","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-21","sources":[{"report_type":"sandbox","report_id":"635f33b171ff3f101e0c4356"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"WaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")\n Found reference to API \"WaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"CreateThreadpoolWait\" (Indicator: \"CreateThread\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"ICorDebugManagedCallback::CreateThread\" (Indicator: \"CreateThread\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")\n Found reference to API \"CreateThreadpoolWait\" (Indicator: \"CreateThread\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")\n Found reference to API \"ICorDebugManagedCallback::CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibraryWhenCallbackReturns\" (Indicator: \"FreeLibrary\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"FreeLibraryWhenCallbackReturns\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00005436.00000000.68657.03180000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\Global\\ProcmonDebugLogger; Source: \"ProcDump_benign.bin\")\n Found string - \\\\.\\Global\\ProcmonDebugLogger; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"ProcDump_benign.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"ProcDump_benign.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$28","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential URLs in memory dumps","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\".exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005436)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"\".exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005436)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\".exe\" called \"GetVersionExA\" (UID: 00000000-00005436)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve default language settings","description":"\".exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00005436)","origin":"API Call","mitre_attack_id":"T1614.001","relevance":3,"id":"api-149","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.dll at 30712-1390-000000014000A4B0\n GetTickCount@KERNEL32.dll at 30712-694-0000000140005870\n GetTickCount@KERNEL32.dll at 30712-668-000000014000F890\n GetTickCount@KERNEL32.dll at 30712-672-000000014000F0D0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 30712-1401-000000014001E9D6","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found reference to API \"EnumSystemLocalesEx\" (Indicator: \"EnumSystemLocales\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"EnumSystemLocalesEx\" (Indicator: \"EnumSystemLocales\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"Set to:\" (Indicator: \"set \"; File: \"ProcDump_benign.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"EnumWindows\" (Indicator: \"EnumWindows\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")\n Found reference to API \"EnumWindows\" (Indicator: \"EnumWindows\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"ProcDump_benign.bin\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"OpenProcessToken@ADVAPI32.dll at 30712-689-0000000140008130\n OpenProcess@KERNEL32.dll at 30712-688-0000000140006D40","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"ICorDebugManagedCallback::CreateProcess\" (Indicator: \"CreateProcess\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"RtlCreateProcessReflection\" (Indicator: \"CreateProcess\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"ICorDebugManagedCallback::CreateProcess\" (Indicator: \"CreateProcess\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")\n Found reference to API \"RtlCreateProcessReflection\" (Indicator: \"CreateProcess\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegCreateKeyW\" (Indicator: \"RegCreateKey\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"RegCreateKeyW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")\n Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFile2\" (Indicator: \"CreateFile\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"CreateFile2\" (Indicator: \"CreateFile\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"General","name":"Contains ability to load modules (API string)","description":"Found reference to API \"ICorDebugManagedCallback::LoadModule\" (Indicator: \"LoadModule\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"ICorDebugManagedCallback::LoadModule\" (Indicator: \"LoadModule\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-424","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"General","name":"Contains reference to Sysinternals URL","description":"Found string \"http://www.sysinternals.com 0\" (Indicator: \"www.sysinternals.com\"; File: \"ProcDump_benign.bin\")\n Found string \"Sysinternals - www.sysinternals.com\" (Indicator: \"www.sysinternals.com\"; File: \"ProcDump_benign.bin\")\n Found string \"ls - www.sysinternals.com\" (Indicator: \"www.sysinternals.com\"; File: \"ProcDump_benign.bin\")\n Found string \"als - www.sysinternals.com\" (Indicator: \"www.sysinternals.com\"; File: \"ProcDump_benign.bin\")\n Found string \"Sysinternals - www.sysinternals.com\" (Indicator: \"www.sysinternals.com\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp, 00000000-00005436.00000000.68657.031CB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-262","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"General","name":"Contains the ability to enumerate service (API string)","description":"Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"EnumServicesStatusExW\" (Indicator: \"EnumServicesStatus\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")\n Found reference to API \"EnumServicesStatusExW\" (Indicator: \"EnumServicesStatus\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5436:304:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\SM0:5436:120:WilError_01\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"ProcDump_benign.bin\" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\".exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 84160000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\".exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 866D0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"ProcDump_benign.bin\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"ProcDump_benign.bin\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"ProcDump_benign.bin\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"General","name":"Sample shows a variety of benign indicators","description":"The input file/all extracted files were not detected as malicious and the input file is signed with a validated certificate","origin":"Indicator Combinations","relevance":10,"id":"summary-6","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"General","name":"The input sample is signed with a valid certificate","description":"The entire certificate chain of the input sample was validated successfully.","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-2","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\".exe\" reads file \"c:\\windows\\win.ini\"\n \".exe\" reads file \"c:\\windows\\fonts\\staticcache.dat\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: The input sample contains a known anti-VM trick\n Matched sigs: Contains ability to detect virtual environment (API)\n Matched sigs: Contains ability to delay the execution of current thread","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$2f","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\".exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\PDH.DLL\"\n \".exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\FLTLIB.DLL\"\n \".exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\RICHED32.DLL\"\n \".exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\RICHED20.DLL\"\n \".exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\USP10.DLL\"\n \".exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\MSLS31.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\".exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\PROCDUMP_BENIGN.EXE.LOCAL\"\n \".exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\Windows\\System32\\UXTHEME.DLL.CONFIG\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"Found URL \"http://www.microsoft.com/exporting\" - Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"Found reference to API \"RegQueryValueExW\" (Indicator: \"RegQueryValue\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"RegOpenKeyW\" (Indicator: \"RegOpenKey\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"RegOpenKeyExW\" (Indicator: \"RegOpenKey\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"RegQueryValueExW\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")\n Found reference to API \"RegOpenKeyW\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")\n Found reference to API \"RegOpenKeyExW\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"file/memory contains long string with (Indicator: \"password\"; File: \"ProcDump_benign.bin\")\n file/memory contains long string with (Indicator: \"password\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"password\"; Source: \"00000000-00005436.00000000.68657.CE270000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00005436.00000000.68657.CE270000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\\ProcDump_benign.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00005436.00000000.68657.CE270000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry key/value (API string)","description":"Found reference to API \"RegDeleteKeyW\" (Indicator: \"RegDeleteKey\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"RegDeleteKeyW\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")\n Found reference to API \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")\n Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")\n Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: ProcDump_benign.bin\n Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00005436.00000000.68657.031A9000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"ICorDebugManagedCallback::ExitProcess\" (Indicator: \"ExitProcess\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")\n Found reference to API \"ICorDebugManagedCallback::ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CONHOST.EXE\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify thread functionality - possible hijack (API string)","description":"Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"ProcDump_benign.bin\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")\n Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00005436.00000000.68657.031A9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to enumerate services","description":"OpenSCManagerW@ADVAPI32.dll at 30712-885-000000014000A68B","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1007","relevance":7,"id":"stream-27","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleW@KERNEL32.dll at 30712-702-0000000140004DD0\n GetModuleHandleW@KERNEL32.dll at 30712-675-000000014000F640\n GetModuleHandleW@KERNEL32.dll at 30712-683-0000000140009670\n GetModuleHandleW@KERNEL32.dll at 30712-668-000000014000F890\n GetModuleHandleW@KERNEL32.dll at 30712-670-0000000140009410\n GetModuleHandleW@KERNEL32.dll at 30712-745-0000000140001160\n GetModuleHandleW@KERNEL32.dll at 30712-693-00000001400094C0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system","description":"GetSystemInfo@KERNEL32.dll at 30712-654-0000000140010A30","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"suspicious","category":"General","name":"Contains ability to modify processes thread functionality","description":"OpenThread@KERNEL32.dll at 30712-837-0000000140006990\n OpenThread@KERNEL32.dll at 30712-677-000000014000E0E0\n ResumeThread@KERNEL32.dll at 30712-688-0000000140006D40","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-129","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\".exe\" reads file \"C:\\Windows\\win.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found a string that may be used as part of an injection method","description":"\"Shell_TrayWnd\" (Taskbar window class may be used to inject into explorer with the SetWindowLong method) in Source: 00000000-00005436.00000000.68657.CE7F0000.00000002.mdmp\n \"!Progman\" (Program manager) in Source: 00000000-00005436.00000000.68657.CE7F0000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1055.011","relevance":4,"id":"string-4","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - Sysinternal Tool","description":"YARA signature for Sysinternal tool file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1573","relevance":2,"id":"yara-123","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"EnumProcessModules@PSAPI.DLL at 30712-816-0000000140005F3B\n CreateToolhelp32Snapshot@KERNEL32.dll at 30712-885-000000014000A68B\n CreateToolhelp32Snapshot@KERNEL32.dll at 30712-690-000000014000A9A0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the command-line string for the current process","description":"GetCommandLineW@KERNEL32.dll at 30712-1-00000001400142FC\n GetCommandLineW@KERNEL32.dll at 30712-672-000000014000F0D0\n GetCommandLineW@KERNEL32.dll at 30712-688-0000000140006D40","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-118","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module","description":"GetModuleFileNameW@KERNEL32.dll at 30712-688-0000000140006D40","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-131","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Read windows product name from registry","description":"\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"PRODUCTNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-105","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$33","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]}],"incidents":[{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the active computer name"},{"detail":"Contains ability to retrieve information about the current system"}],"sources":[{"report_type":"sandbox","report_id":"635f33b171ff3f101e0c4356"}]},{"name":"Evasive","details_count":5,"details":[{"detail":"The input sample contains a known anti-VM trick"},{"detail":"Contains ability to check if a debugger is running"},{"detail":"Contains ability to adjust token privileges"},{"detail":"Contains ability to detect virtual environment (API)"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"635f33b171ff3f101e0c4356"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":52,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":6,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":6,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["ausiv","autorun","chir","crypt","cryptinject","downloader","expiro","floxif","generik","hacktool","metasploit","meterpreter","mofksys","neshta","parite","rozena","sality","swrort","zpevdo"],"sample_flags":["Sample not shared"],"sandbox_reports":[{"id":"65019383296401939600da81","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"clean","submit_name":"ProcDump_benign","analysis_start_time":"2023-09-13T10:48:35+00:00","indicators_count":{"informative":101,"suspicious":20,"malicious":1},"tags":["Sample not shared"],"is_in_unified_schema":true},{"id":"635f33b171ff3f101e0c4356","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"clean","submit_name":"F4C8369E4DE1F12CC5A71EB5586B38FC78A9D8DB2B189B8C25EF17A572D4D6B7","analysis_start_time":"2022-10-31T02:32:18+00:00","indicators_count":{"informative":27,"suspicious":20,"malicious":2},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"635f33b171ff3f101e0c4356"}],"processes":[{"pid":3816,"ppid":0,"name":"f4c8369e4de1f12cc5a71eb5586b38fc78a9d8db2b189b8c25ef17a572d4d6b7.exe","command_line":"","sha256":"f4c8369e4de1f12cc5a71eb5586b38fc78a9d8db2b189b8c25ef17a572d4d6b7","normalized_path":"C:\\f4c8369e4de1f12cc5a71eb5586b38fc78a9d8db2b189b8c25ef17a572d4d6b7.exe","uid":"00000000-00003816","icon":"$34"}],"all_imported_dlls":["KernelBase.dll","ntdll.dll","ws2_32.dll","sechost.dll","riched32.dll","dwmapi.dll","rpcss.dll","kernel32.dll","oleaut32.dll","cryptbase.dll","api-ms-win-core-synch-l1-2-0.dll","pdh.dll","msctf.dll","clbcatq.dll","nsi.dll","rpcrt4.dll","shlwapi.dll","VxSSL64.dll","lpk.dll","comdlg32.dll","ole32.dll","psapi.dll","user32.dll","comctl32.dll","advapi32.dll","riched20.dll","uxtheme.dll","gdi32.dll","usp10.dll","msvcrt.dll","shell32.dll","imm32.dll","fltLib.dll","CoreUIComponents.dll","msvcp_win.dll","bcryptprimitives.dll","ucrtbase.dll","combase.dll","ntmarta.dll","WinTypes.dll","apphelp.dll","TextInputFramework.dll","CoreMessaging.dll","gdi32full.dll","SHCore.dll","kernel.appcore.dll","win32u.dll","cfgmgr32.dll","windows.storage.dll","profapi.dll","powrprof.dll","msls31.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\SYSINTERNALS\\PROCDUMP\\","sources":[{"report_type":"sandbox","report_id":"635f33b171ff3f101e0c4356"}]},{"key":"HKCU\\SOFTWARE\\SYSINTERNALS\\","sources":[{"report_type":"sandbox","report_id":"635f33b171ff3f101e0c4356"}]},{"key":"HKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"635f33b171ff3f101e0c4356"}]},{"key":"HKCUHKCU\\SOFTWARE\\SYSINTERNALS\\PROCDUMP\\","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"key":"HKCUHKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"key":"HKCUHKCU\\SOFTWARE\\SYSINTERNALS\\","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5436:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5436:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"65019383296401939600da81"}]}]}},"report_ids":{"sandbox_job_ids":["65019383296401939600da81","635f33b171ff3f101e0c4356"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Clean Sample f4c8369e4de1… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Clean verdict for sample f4c8369e4de1…. Threat score 0/100. 0/24 AV engines flagged this file. 2 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/f4c8369e4de1f12cc5a71eb5586b38fc78a9d8db2b189b8c25ef17a572d4d6b7"}],["$","meta","4",{"property":"og:title","content":"Clean Sample f4c8369e4de1… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Clean verdict for sample f4c8369e4de1…. Threat score 0/100. 0/24 AV engines flagged this file. 2 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/f4c8369e4de1f12cc5a71eb5586b38fc78a9d8db2b189b8c25ef17a572d4d6b7"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Clean Sample f4c8369e4de1… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Clean verdict for sample f4c8369e4de1…. Threat score 0/100. 0/24 AV engines flagged this file. 2 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L35","11",{}]]