Hybrid Analysis
- 05 Aug 2023
- 70 Minutes to read
- Contributors
- Print
- DarkLight
Hybrid Analysis
- Updated on 05 Aug 2023
- 70 Minutes to read
- Contributors
- Print
- DarkLight
Article Summary
Share feedback
Thanks for sharing your feedback!
Hybrid Analysis, aka Falcon Sandbox, is a powerful, free malware analysis service for the community that detects and analyzes unknown threats. Hybrid Analysis has its own unique approach, and offers both public-facing and private team-based sandboxing capabilities.
LimaCharlie integrates with the following Hybrid Analysis API calls:
Detection & Response Rules
Overview
The Search API accepts a SHA256 value, and provides an extensive overview of a hash (if previously observed by the platform).
D&R Rule:
The following D&R rule
event: NEW_PROCESS
op: lookup
path: event/HASH
resource: lcr://api/hybrid-analysis-overview
Response Data:
{
"result": {
"analysis_start_time": "2023-07-17T18:31:04+00:00",
"architecture": "WINDOWS",
"children_in_progress": 0,
"children_in_queue": 0,
"last_file_name": "cmd.exe",
"last_multi_scan": "2023-07-17T18:31:09+00:00",
"multiscan_result": 0,
"other_file_name": [
"Utilman.exe",
"file",
"kiss.exe",
"osk.exe",
"sethc.exe",
"utilman.exe"
],
"related_children_hashes": [],
"related_parent_hashes": [
"c502bd80423e10dcc4b59fe4b523acb5ce0bd07748f73c7bdc6c797883b8a417"
],
"related_reports": [
{
"environment_id": 100,
"error_origin": null,
"error_type": null,
"job_id": "627e3011d695730f2c3ad419",
"sha256": "c502bd80423e10dcc4b59fe4b523acb5ce0bd07748f73c7bdc6c797883b8a417",
"state": "SUCCESS",
"verdict": "no verdict"
}
],
"reports": [
"58593319aac2edc56d351531",
"5a34f2a27ca3e13531789a95",
"5f196598eac13102deff3d42",
"64b588e7e14d64e6a60b2130",
"5965d8027ca3e10ec737634f",
"60251a499b1b3016bb674fb4",
"637f3600a3d94f1ecc7c1800"
],
"scanners": [
{
"anti_virus_results": [],
"error_message": null,
"name": "CrowdStrike Falcon Static Analysis (ML)",
"percent": 0,
"positives": null,
"progress": 100,
"status": "clean",
"total": null
},
{
"anti_virus_results": [],
"error_message": null,
"name": "Metadefender",
"percent": 0,
"positives": 0,
"progress": 100,
"status": "clean",
"total": 27
},
{
"anti_virus_results": [],
"error_message": null,
"name": "VirusTotal",
"percent": 0,
"positives": 0,
"progress": 100,
"status": "clean",
"total": 75
}
],
"scanners_v2": {
"bfore_ai": null,
"clean_dns": null,
"crowdstrike_ml": {
"anti_virus_results": [],
"error_message": null,
"name": "CrowdStrike Falcon Static Analysis (ML)",
"percent": 0,
"progress": 100,
"status": "clean"
},
"metadefender": {
"anti_virus_results": [],
"error_message": null,
"name": "Metadefender",
"percent": 0,
"positives": 0,
"progress": 100,
"status": "clean",
"total": 27
},
"scam_adviser": null,
"urlscan_io": null,
"virustotal": {
"error_message": null,
"name": "VirusTotal",
"percent": 0,
"positives": 0,
"progress": 100,
"status": "clean",
"total": 75
}
},
"sha256": "935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2",
"size": 232960,
"submit_context": [],
"tags": [],
"threat_score": null,
"type": "PE32+ executable (console) x86-64, for MS Windows",
"type_short": [
"peexe",
"64bits",
"executable"
],
"url_analysis": false,
"verdict": "no specific threat",
"vx_family": null,
"whitelisted": false
}
}
Search
The Search lookup provides a basic lookup of a hash value. This look accepts one of the following values:
- MD5
- SHA1
- SHA256
D&R Rule:
event: NEW_PROCESS
op: lookup
path: event/HASH
resource: lcr://api/hybrid-analysis-search
Response Data:
[
{
"classification_tags": [],
"tags": [],
"submissions": [
{
"submission_id": "64b588e7e14d64e6a60b2131",
"filename": "cmd.exe",
"url": null,
"created_at": "2023-07-17T18:31:03+00:00"
}
],
"machine_learning_models": [],
"crowdstrike_ai": {
"executable_process_memory_analysis": [],
"analysis_related_urls": []
},
"job_id": "64b588e7e14d64e6a60b2130",
"environment_id": 160,
"environment_description": "Windows 10 64 bit",
"size": 232960,
"type": "PE32+ executable (console) x86-64, for MS Windows",
"type_short": [
"peexe",
"64bits",
"executable"
],
"target_url": null,
"state": "SUCCESS",
"error_type": null,
"error_origin": null,
"submit_name": "cmd.exe",
"md5": "f4f684066175b77e0c3a000549d2922c",
"sha1": "99ae9c73e9bee6f9c76d6f4093a9882df06832cf",
"sha256": "935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2",
"sha512": "fe8f0593cc335ad28eb90211bc4ff01a3d2992cffb3877d04cefede9ef94afeb1a7d7874dd0c0ae04eaf8308291d5a4d879e6ecf6fe2b8d0ff1c3ac7ef143206",
"ssdeep": "3072:bkd4COZG6/A1tO1Y6TbkX2FtynroeJ/MEJoSsasbLLkhyjyGe:bkuC9+Af0Y6TbbFtkoeJk1KsfLXm",
"imphash": "3062ed732d4b25d1c64f084dac97d37a",
"entrypoint": "0x140015190",
"entrypoint_section": ".text",
"image_base": "0x140000000",
"subsystem": "Windows Cui",
"image_file_characteristics": [
"EXECUTABLE_IMAGE",
"LARGE_ADDRESS_AWARE"
],
"dll_characteristics": [
"GUARD_CF",
"TERMINAL_SERVER_AWARE",
"DYNAMIC_BASE",
"NX_COMPAT",
"HIGH_ENTROPY_VA"
],
"major_os_version": 10,
"minor_os_version": 0,
"av_detect": 0,
"vx_family": null,
"url_analysis": false,
"analysis_start_time": "2023-07-17T18:31:04+00:00",
"threat_score": null,
"interesting": false,
"threat_level": 0,
"verdict": "no specific threat",
"certificates": [],
"is_certificates_valid": false,
"certificates_validation_message": "No signature was present in the subject. (0x800b0100)",
"domains": [],
"compromised_hosts": [],
"hosts": [],
"total_network_connections": 0,
"total_processes": 1,
"total_signatures": 99,
"extracted_files": [],
"file_metadata": null,
"processes": [],
"mitre_attcks": [
{
"tactic": "Execution",
"technique": "Shared Modules",
"attck_id": "T1129",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1129",
"malicious_identifiers_count": 0,
"malicious_identifiers": [],
"suspicious_identifiers_count": 0,
"suspicious_identifiers": [],
"informative_identifiers_count": 3,
"informative_identifiers": [],
"parent": null
},
{
"tactic": "Execution",
"technique": "Native API",
"attck_id": "T1106",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1106",
"malicious_identifiers_count": 0,
"malicious_identifiers": [],
"suspicious_identifiers_count": 2,
"suspicious_identifiers": [],
"informative_identifiers_count": 10,
"informative_identifiers": [],
"parent": null
},
{
"tactic": "Execution",
"technique": "Windows Command Shell",
"attck_id": "T1059.003",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1059/003",
"malicious_identifiers_count": 0,
"malicious_identifiers": [],
"suspicious_identifiers_count": 0,
"suspicious_identifiers": [],
"informative_identifiers_count": 1,
"informative_identifiers": [],
"parent": {
"technique": "Command and Scripting Interpreter",
"attck_id": "T1059",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1059"
}
},
{
"tactic": "Persistence",
"technique": "Windows Service",
"attck_id": "T1543.003",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1543/003",
"malicious_identifiers_count": 0,
"malicious_identifiers": [],
"suspicious_identifiers_count": 0,
"suspicious_identifiers": [],
"informative_identifiers_count": 2,
"informative_identifiers": [],
"parent": {
"technique": "Create or Modify System Process",
"attck_id": "T1543",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1543"
}
},
{
"tactic": "Persistence",
"technique": "Create or Modify System Process",
"attck_id": "T1543",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1543",
"malicious_identifiers_count": 0,
"malicious_identifiers": [],
"suspicious_identifiers_count": 0,
"suspicious_identifiers": [],
"informative_identifiers_count": 1,
"informative_identifiers": [],
"parent": null
},
{
"tactic": "Persistence",
"technique": "Registry Run Keys / Startup Folder",
"attck_id": "T1547.001",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1547/001",
"malicious_identifiers_count": 0,
"malicious_identifiers": [],
"suspicious_identifiers_count": 0,
"suspicious_identifiers": [],
"informative_identifiers_count": 1,
"informative_identifiers": [],
"parent": {
"technique": "Boot or Logon Autostart Execution",
"attck_id": "T1547",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1547"
}
},
{
"tactic": "Privilege Escalation",
"technique": "Windows Service",
"attck_id": "T1543.003",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1543/003",
"malicious_identifiers_count": 0,
"malicious_identifiers": [],
"suspicious_identifiers_count": 0,
"suspicious_identifiers": [],
"informative_identifiers_count": 2,
"informative_identifiers": [],
"parent": {
"technique": "Create or Modify System Process",
"attck_id": "T1543",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1543"
}
},
{
"tactic": "Privilege Escalation",
"technique": "Token Impersonation/Theft",
"attck_id": "T1134.001",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1134/001",
"malicious_identifiers_count": 0,
"malicious_identifiers": [],
"suspicious_identifiers_count": 0,
"suspicious_identifiers": [],
"informative_identifiers_count": 3,
"informative_identifiers": [],
"parent": {
"technique": "Access Token Manipulation",
"attck_id": "T1134",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1134"
}
},
{
"tactic": "Privilege Escalation",
"technique": "Create or Modify System Process",
"attck_id": "T1543",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1543",
"malicious_identifiers_count": 0,
"malicious_identifiers": [],
"suspicious_identifiers_count": 0,
"suspicious_identifiers": [],
"informative_identifiers_count": 1,
"informative_identifiers": [],
"parent": null
},
{
"tactic": "Privilege Escalation",
"technique": "Create Process with Token",
"attck_id": "T1134.002",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1134/002",
"malicious_identifiers_count": 0,
"malicious_identifiers": [],
"suspicious_identifiers_count": 0,
"suspicious_identifiers": [],
"informative_identifiers_count": 1,
"informative_identifiers": [],
"parent": {
"technique": "Access Token Manipulation",
"attck_id": "T1134",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1134"
}
},
{
"tactic": "Privilege Escalation",
"technique": "Dynamic-link Library Injection",
"attck_id": "T1055.001",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1055/001",
"malicious_identifiers_count": 0,
"malicious_identifiers": [],
"suspicious_identifiers_count": 0,
"suspicious_identifiers": [],
"informative_identifiers_count": 1,
"informative_identifiers": [],
"parent": {
"technique": "Process Injection",
"attck_id": "T1055",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1055"
}
},
{
"tactic": "Privilege Escalation",
"technique": "Thread Execution Hijacking",
"attck_id": "T1055.003",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1055/003",
"malicious_identifiers_count": 0,
"malicious_identifiers": [],
"suspicious_identifiers_count": 1,
"suspicious_identifiers": [],
"informative_identifiers_count": 0,
"informative_identifiers": [],
"parent": {
"technique": "Process Injection",
"attck_id": "T1055",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1055"
}
},
{
"tactic": "Privilege Escalation",
"technique": "Process Injection",
"attck_id": "T1055",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1055",
"malicious_identifiers_count": 0,
"malicious_identifiers": [],
"suspicious_identifiers_count": 0,
"suspicious_identifiers": [],
"informative_identifiers_count": 2,
"informative_identifiers": [],
"parent": null
},
{
"tactic": "Privilege Escalation",
"technique": "Registry Run Keys / Startup Folder",
"attck_id": "T1547.001",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1547/001",
"malicious_identifiers_count": 0,
"malicious_identifiers": [],
"suspicious_identifiers_count": 0,
"suspicious_identifiers": [],
"informative_identifiers_count": 1,
"informative_identifiers": [],
"parent": {
"technique": "Boot or Logon Autostart Execution",
"attck_id": "T1547",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1547"
}
},
{
"tactic": "Privilege Escalation",
"technique": "Extra Window Memory Injection",
"attck_id": "T1055.011",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1055/011",
"malicious_identifiers_count": 0,
"malicious_identifiers": [],
"suspicious_identifiers_count": 1,
"suspicious_identifiers": [],
"informative_identifiers_count": 0,
"informative_identifiers": [],
"parent": {
"technique": "Process Injection",
"attck_id": "T1055",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1055"
}
},
{
"tactic": "Defense Evasion",
"technique": "Obfuscated Files or Information",
"attck_id": "T1027",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1027",
"malicious_identifiers_count": 0,
"malicious_identifiers": [],
"suspicious_identifiers_count": 0,
"suspicious_identifiers": [],
"informative_identifiers_count": 2,
"informative_identifiers": [],
"parent": null
},
{
"tactic": "Defense Evasion",
"technique": "Match Legitimate Name or Location",
"attck_id": "T1036.005",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1036/005",
"malicious_identifiers_count": 1,
"malicious_identifiers": [],
"suspicious_identifiers_count": 0,
"suspicious_identifiers": [],
"informative_identifiers_count": 0,
"informative_identifiers": [],
"parent": {
"technique": "Masquerading",
"attck_id": "T1036",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1036"
}
},
{
"tactic": "Defense Evasion",
"technique": "Debugger Evasion",
"attck_id": "T1622",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1622",
"malicious_identifiers_count": 0,
"malicious_identifiers": [],
"suspicious_identifiers_count": 0,
"suspicious_identifiers": [],
"informative_identifiers_count": 2,
"informative_identifiers": [],
"parent": null
},
{
"tactic": "Defense Evasion",
"technique": "File and Directory Permissions Modification",
"attck_id": "T1222",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1222",
"malicious_identifiers_count": 0,
"malicious_identifiers": [],
"suspicious_identifiers_count": 0,
"suspicious_identifiers": [],
"informative_identifiers_count": 1,
"informative_identifiers": [],
"parent": null
},
{
"tactic": "Defense Evasion",
"technique": "Token Impersonation/Theft",
"attck_id": "T1134.001",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1134/001",
"malicious_identifiers_count": 0,
"malicious_identifiers": [],
"suspicious_identifiers_count": 0,
"suspicious_identifiers": [],
"informative_identifiers_count": 3,
"informative_identifiers": [],
"parent": {
"technique": "Access Token Manipulation",
"attck_id": "T1134",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1134"
}
},
{
"tactic": "Defense Evasion",
"technique": "Timestomp",
"attck_id": "T1070.006",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1070/006",
"malicious_identifiers_count": 0,
"malicious_identifiers": [],
"suspicious_identifiers_count": 0,
"suspicious_identifiers": [],
"informative_identifiers_count": 2,
"informative_identifiers": [],
"parent": {
"technique": "Indicator Removal",
"attck_id": "T1070",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1070"
}
},
{
"tactic": "Defense Evasion",
"technique": "Modify Registry",
"attck_id": "T1112",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1112",
"malicious_identifiers_count": 0,
"malicious_identifiers": [],
"suspicious_identifiers_count": 0,
"suspicious_identifiers": [],
"informative_identifiers_count": 4,
"informative_identifiers": [],
"parent": null
},
{
"tactic": "Defense Evasion",
"technique": "Disable or Modify Tools",
"attck_id": "T1562.001",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1562/001",
"malicious_identifiers_count": 0,
"malicious_identifiers": [],
"suspicious_identifiers_count": 0,
"suspicious_identifiers": [],
"informative_identifiers_count": 1,
"informative_identifiers": [],
"parent": {
"technique": "Impair Defenses",
"attck_id": "T1562",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1562"
}
},
{
"tactic": "Defense Evasion",
"technique": "Create Process with Token",
"attck_id": "T1134.002",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1134/002",
"malicious_identifiers_count": 0,
"malicious_identifiers": [],
"suspicious_identifiers_count": 0,
"suspicious_identifiers": [],
"informative_identifiers_count": 1,
"informative_identifiers": [],
"parent": {
"technique": "Access Token Manipulation",
"attck_id": "T1134",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1134"
}
},
{
"tactic": "Defense Evasion",
"technique": "Dynamic-link Library Injection",
"attck_id": "T1055.001",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1055/001",
"malicious_identifiers_count": 0,
"malicious_identifiers": [],
"suspicious_identifiers_count": 0,
"suspicious_identifiers": [],
"informative_identifiers_count": 1,
"informative_identifiers": [],
"parent": {
"technique": "Process Injection",
"attck_id": "T1055",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1055"
}
},
{
"tactic": "Defense Evasion",
"technique": "Thread Execution Hijacking",
"attck_id": "T1055.003",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1055/003",
"malicious_identifiers_count": 0,
"malicious_identifiers": [],
"suspicious_identifiers_count": 1,
"suspicious_identifiers": [],
"informative_identifiers_count": 0,
"informative_identifiers": [],
"parent": {
"technique": "Process Injection",
"attck_id": "T1055",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1055"
}
},
{
"tactic": "Defense Evasion",
"technique": "Process Injection",
"attck_id": "T1055",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1055",
"malicious_identifiers_count": 0,
"malicious_identifiers": [],
"suspicious_identifiers_count": 0,
"suspicious_identifiers": [],
"informative_identifiers_count": 2,
"informative_identifiers": [],
"parent": null
},
{
"tactic": "Defense Evasion",
"technique": "File Deletion",
"attck_id": "T1070.004",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1070/004",
"malicious_identifiers_count": 0,
"malicious_identifiers": [],
"suspicious_identifiers_count": 0,
"suspicious_identifiers": [],
"informative_identifiers_count": 1,
"informative_identifiers": [],
"parent": {
"technique": "Indicator Removal",
"attck_id": "T1070",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1070"
}
},
{
"tactic": "Defense Evasion",
"technique": "Direct Volume Access",
"attck_id": "T1006",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1006",
"malicious_identifiers_count": 0,
"malicious_identifiers": [],
"suspicious_identifiers_count": 0,
"suspicious_identifiers": [],
"informative_identifiers_count": 1,
"informative_identifiers": [],
"parent": null
},
{
"tactic": "Defense Evasion",
"technique": "Time Based Evasion",
"attck_id": "T1497.003",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1497/003",
"malicious_identifiers_count": 0,
"malicious_identifiers": [],
"suspicious_identifiers_count": 0,
"suspicious_identifiers": [],
"informative_identifiers_count": 2,
"informative_identifiers": [],
"parent": {
"technique": "Virtualization/Sandbox Evasion",
"attck_id": "T1497",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1497"
}
},
{
"tactic": "Defense Evasion",
"technique": "Software Packing",
"attck_id": "T1027.002",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1027/002",
"malicious_identifiers_count": 0,
"malicious_identifiers": [],
"suspicious_identifiers_count": 3,
"suspicious_identifiers": [],
"informative_identifiers_count": 0,
"informative_identifiers": [],
"parent": {
"technique": "Obfuscated Files or Information",
"attck_id": "T1027",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1027"
}
},
{
"tactic": "Defense Evasion",
"technique": "Extra Window Memory Injection",
"attck_id": "T1055.011",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1055/011",
"malicious_identifiers_count": 0,
"malicious_identifiers": [],
"suspicious_identifiers_count": 1,
"suspicious_identifiers": [],
"informative_identifiers_count": 0,
"informative_identifiers": [],
"parent": {
"technique": "Process Injection",
"attck_id": "T1055",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1055"
}
},
{
"tactic": "Credential Access",
"technique": "Credential API Hooking",
"attck_id": "T1056.004",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1056/004",
"malicious_identifiers_count": 0,
"malicious_identifiers": [],
"suspicious_identifiers_count": 1,
"suspicious_identifiers": [],
"informative_identifiers_count": 0,
"informative_identifiers": [],
"parent": {
"technique": "Input Capture",
"attck_id": "T1056",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1056"
}
},
{
"tactic": "Discovery",
"technique": "File and Directory Discovery",
"attck_id": "T1083",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1083",
"malicious_identifiers_count": 0,
"malicious_identifiers": [],
"suspicious_identifiers_count": 0,
"suspicious_identifiers": [],
"informative_identifiers_count": 7,
"informative_identifiers": [],
"parent": null
},
{
"tactic": "Discovery",
"technique": "Process Discovery",
"attck_id": "T1057",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1057",
"malicious_identifiers_count": 0,
"malicious_identifiers": [],
"suspicious_identifiers_count": 1,
"suspicious_identifiers": [],
"informative_identifiers_count": 4,
"informative_identifiers": [],
"parent": null
},
{
"tactic": "Discovery",
"technique": "Query Registry",
"attck_id": "T1012",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1012",
"malicious_identifiers_count": 0,
"malicious_identifiers": [],
"suspicious_identifiers_count": 1,
"suspicious_identifiers": [],
"informative_identifiers_count": 4,
"informative_identifiers": [],
"parent": null
},
{
"tactic": "Discovery",
"technique": "System Service Discovery",
"attck_id": "T1007",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1007",
"malicious_identifiers_count": 0,
"malicious_identifiers": [],
"suspicious_identifiers_count": 0,
"suspicious_identifiers": [],
"informative_identifiers_count": 1,
"informative_identifiers": [],
"parent": null
},
{
"tactic": "Discovery",
"technique": "System Information Discovery",
"attck_id": "T1082",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1082",
"malicious_identifiers_count": 0,
"malicious_identifiers": [],
"suspicious_identifiers_count": 0,
"suspicious_identifiers": [],
"informative_identifiers_count": 9,
"informative_identifiers": [],
"parent": null
},
{
"tactic": "Discovery",
"technique": "System Language Discovery",
"attck_id": "T1614.001",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1614/001",
"malicious_identifiers_count": 0,
"malicious_identifiers": [],
"suspicious_identifiers_count": 0,
"suspicious_identifiers": [],
"informative_identifiers_count": 1,
"informative_identifiers": [],
"parent": {
"technique": "System Location Discovery",
"attck_id": "T1614",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1614"
}
},
{
"tactic": "Discovery",
"technique": "Debugger Evasion",
"attck_id": "T1622",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1622",
"malicious_identifiers_count": 0,
"malicious_identifiers": [],
"suspicious_identifiers_count": 0,
"suspicious_identifiers": [],
"informative_identifiers_count": 2,
"informative_identifiers": [],
"parent": null
},
{
"tactic": "Discovery",
"technique": "System Owner/User Discovery",
"attck_id": "T1033",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1033",
"malicious_identifiers_count": 0,
"malicious_identifiers": [],
"suspicious_identifiers_count": 0,
"suspicious_identifiers": [],
"informative_identifiers_count": 1,
"informative_identifiers": [],
"parent": null
},
{
"tactic": "Discovery",
"technique": "System Network Connections Discovery",
"attck_id": "T1049",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1049",
"malicious_identifiers_count": 0,
"malicious_identifiers": [],
"suspicious_identifiers_count": 0,
"suspicious_identifiers": [],
"informative_identifiers_count": 1,
"informative_identifiers": [],
"parent": null
},
{
"tactic": "Discovery",
"technique": "System Network Configuration Discovery",
"attck_id": "T1016",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1016",
"malicious_identifiers_count": 0,
"malicious_identifiers": [],
"suspicious_identifiers_count": 0,
"suspicious_identifiers": [],
"informative_identifiers_count": 1,
"informative_identifiers": [],
"parent": null
},
{
"tactic": "Discovery",
"technique": "Network Share Discovery",
"attck_id": "T1135",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1135",
"malicious_identifiers_count": 0,
"malicious_identifiers": [],
"suspicious_identifiers_count": 0,
"suspicious_identifiers": [],
"informative_identifiers_count": 1,
"informative_identifiers": [],
"parent": null
},
{
"tactic": "Discovery",
"technique": "System Location Discovery",
"attck_id": "T1614",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1614",
"malicious_identifiers_count": 0,
"malicious_identifiers": [],
"suspicious_identifiers_count": 0,
"suspicious_identifiers": [],
"informative_identifiers_count": 1,
"informative_identifiers": [],
"parent": null
},
{
"tactic": "Discovery",
"technique": "System Time Discovery",
"attck_id": "T1124",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1124",
"malicious_identifiers_count": 0,
"malicious_identifiers": [],
"suspicious_identifiers_count": 0,
"suspicious_identifiers": [],
"informative_identifiers_count": 1,
"informative_identifiers": [],
"parent": null
},
{
"tactic": "Discovery",
"technique": "Time Based Evasion",
"attck_id": "T1497.003",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1497/003",
"malicious_identifiers_count": 0,
"malicious_identifiers": [],
"suspicious_identifiers_count": 0,
"suspicious_identifiers": [],
"informative_identifiers_count": 2,
"informative_identifiers": [],
"parent": {
"technique": "Virtualization/Sandbox Evasion",
"attck_id": "T1497",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1497"
}
},
{
"tactic": "Lateral Movement",
"technique": "Lateral Tool Transfer",
"attck_id": "T1570",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1570",
"malicious_identifiers_count": 0,
"malicious_identifiers": [],
"suspicious_identifiers_count": 0,
"suspicious_identifiers": [],
"informative_identifiers_count": 1,
"informative_identifiers": [],
"parent": null
},
{
"tactic": "Collection",
"technique": "Credential API Hooking",
"attck_id": "T1056.004",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1056/004",
"malicious_identifiers_count": 0,
"malicious_identifiers": [],
"suspicious_identifiers_count": 1,
"suspicious_identifiers": [],
"informative_identifiers_count": 0,
"informative_identifiers": [],
"parent": {
"technique": "Input Capture",
"attck_id": "T1056",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1056"
}
},
{
"tactic": "Collection",
"technique": "Local Data Staging",
"attck_id": "T1074.001",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1074/001",
"malicious_identifiers_count": 0,
"malicious_identifiers": [],
"suspicious_identifiers_count": 0,
"suspicious_identifiers": [],
"informative_identifiers_count": 1,
"informative_identifiers": [],
"parent": {
"technique": "Data Staged",
"attck_id": "T1074",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1074"
}
},
{
"tactic": "Command and Control",
"technique": "Application Layer Protocol",
"attck_id": "T1071",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1071",
"malicious_identifiers_count": 0,
"malicious_identifiers": [],
"suspicious_identifiers_count": 0,
"suspicious_identifiers": [],
"informative_identifiers_count": 1,
"informative_identifiers": [],
"parent": null
},
{
"tactic": "Command and Control",
"technique": "Ingress Tool Transfer",
"attck_id": "T1105",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1105",
"malicious_identifiers_count": 0,
"malicious_identifiers": [],
"suspicious_identifiers_count": 0,
"suspicious_identifiers": [],
"informative_identifiers_count": 1,
"informative_identifiers": [],
"parent": null
},
{
"tactic": "Exfiltration",
"technique": "Scheduled Transfer",
"attck_id": "T1029",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1029",
"malicious_identifiers_count": 0,
"malicious_identifiers": [],
"suspicious_identifiers_count": 0,
"suspicious_identifiers": [],
"informative_identifiers_count": 1,
"informative_identifiers": [],
"parent": null
},
{
"tactic": "Impact",
"technique": "Service Stop",
"attck_id": "T1489",
"attck_id_wiki": "https://attack.mitre.org/techniques/T1489",
"malicious_identifiers_count": 0,
"malicious_identifiers": [],
"suspicious_identifiers_count": 0,
"suspicious_identifiers": [],
"informative_identifiers_count": 1,
"informative_identifiers": [],
"parent": null
}
],
"network_mode": "default",
"signatures": [
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "General",
"identifier": "api-7",
"type": 6,
"relevance": 1,
"name": "Loads modules at runtime",
"description": "\"cmd.exe\" loaded module \"KERNEL32\" at base e8360000\n \"cmd.exe\" loaded module \"API-MS-WIN-CORE-STRING-L1-1-0\" at base e5170000\n \"cmd.exe\" loaded module \"API-MS-WIN-CORE-DATETIME-L1-1-1\" at base e5170000\n \"cmd.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0\" at base e5170000\n \"cmd.exe\" loaded module \"%WINDIR%\\SYSTEM32\\IMM32.DLL\" at base e5be0000\n \"cmd.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base e5170000\n \"cmd.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base e5170000\n \"cmd.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base e5170000\n \"cmd.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE64.DLL\" at base d3ef0000\n \"cmd.exe\" loaded module \"KERNEL32.DLL\" at base e8360000",
"origin": "API Call",
"attck_id": "T1129",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1129"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "General",
"identifier": "api-175",
"type": 6,
"relevance": 1,
"name": "Calls an API typically used to load libraries",
"description": "\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004716)\n \"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004716)\n \"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004716)\n \"cmd.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00004716)",
"origin": "API Call",
"attck_id": "T1129",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1129"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "General",
"identifier": "api-176",
"type": 6,
"relevance": 1,
"name": "Calls an API typically used to retrieve function addresses",
"description": "\"cmd.exe\" called \"GetProcAddress\" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter FlsAlloc (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter FlsSetValue (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter LCMapStringEx (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter FlsFree (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter InitOnceExecuteOnce (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter CreateEventExW (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreW (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreExW (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolTimer (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolTimer (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolTimer (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWait (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolWait (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWait (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter CreateSymbolicLinkW (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter GetCurrentPackageId (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter GetTickCount64 (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter SetFileInformationByHandle (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter InitializeConditionVariable (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter WakeConditionVariable (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter WakeAllConditionVariable (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableCS (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter InitializeSRWLock (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableSRW (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWork (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter SubmitThreadpoolWork (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWork (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter CompareStringEx (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter GetLocaleInfoEx (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter AreFileApisANSI (UID: 00000000-00004716)",
"origin": "API Call",
"attck_id": "T1106",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1106"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "General",
"identifier": "module-10",
"type": 10,
"relevance": 0,
"name": "Loads the RPC (Remote Procedure Call) module DLL",
"description": "\"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at E8420000",
"origin": "Loaded Module",
"attck_id": "T1129",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1129"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "General",
"identifier": "module-9",
"type": 10,
"relevance": 0,
"name": "Loads the Bcrypt module DLL",
"description": "\"cmd.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at E55D0000",
"origin": "Loaded Module",
"attck_id": "T1027",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1027"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "General",
"identifier": "registry-25",
"type": 3,
"relevance": 3,
"name": "Reads information about supported languages",
"description": "\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")",
"origin": "Registry Access",
"attck_id": "T1082",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1082"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "General",
"identifier": "string-101",
"type": 2,
"relevance": 1,
"name": "Contains ability to execute Windows APIs",
"description": "Found reference to API (Indicator: \"SetConsoleInputExeNameW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"IsDebuggerPresent\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"CopyFileExW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"SetThreadUILanguage\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"NtQueryInformationProcess\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"RtlCreateUnicodeStringFromAsciiz\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"RtlNtStatusToDosError\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"NtSetInformationProcess\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"RtlFreeUnicodeString\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"RtlDosPathNameToRelativeNtPathName_U_WithStatus\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"NtSetInformationFile\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"RtlReleaseRelativeName\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"NtQueryVolumeInformationFile\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"NtOpenFile\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"RtlFindLeastSignificantBit\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"RtlDosPathNameToNtPathName_U\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"NtFsControlFile\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"RtlFreeHeap\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"RtlCaptureContext\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"RtlLookupFunctionEntry\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"RtlVirtualUnwind\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"CopyFileW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"ReadFile\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"SetThreadLocale\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"FindFirstFileW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetConsoleScreenBufferInfo\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"HeapFree\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetFullPathNameW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"FindNextFileW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetConsoleOutputCP\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetStdHandle\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetCPInfo\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"SetFilePointer\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"FindClose\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"CreateFileW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"MultiByteToWideChar\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetLastError\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"FillConsoleOutputCharacterW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"ReadConsoleW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"CloseHandle\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"ReleaseSRWLockShared\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"HeapAlloc\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"FlushConsoleInputBuffer\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"WriteConsoleW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetProcAddress\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"AcquireSRWLockShared\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetFileSize\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetProcessHeap\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetModuleHandleW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"WideCharToMultiByte\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetFileType\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"SetConsoleCursorPosition\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"RevertToSelf\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"VirtualQuery\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"SetLocalTime\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetLocaleInfoW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetUserDefaultLCID\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"FileTimeToSystemTime\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"FileTimeToLocalFileTime\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetLocalTime\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetTimeFormatW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"SystemTimeToFileTime\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetSystemTime\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetDateFormatW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetNumaHighestNodeNumber\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetCommandLineW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"SetConsoleMode\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"SetEnvironmentVariableW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetEnvironmentVariableW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"FreeEnvironmentStringsW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetConsoleMode\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"SetEnvironmentStringsW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetEnvironmentStringsW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetStartupInfoW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"RegQueryValueExW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"NeedCurrentDirectoryForExePathW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"SetLastError\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"RegDeleteValueW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"InitializeProcThreadAttributeList\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"CreateProcessAsUserW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"RegOpenKeyExW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"SetErrorMode\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetConsoleTitleW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetFileAttributesW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"RegSetValueExW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"RegEnumKeyExW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"UpdateProcThreadAttribute\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"RegCreateKeyExW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"DeleteProcThreadAttributeList\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"ReadProcessMemory\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"CreateProcessW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"RegDeleteKeyExW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"RegCloseKey\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"LoadLibraryExW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"MoveFileWithProgressW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"LocalFree\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"MoveFileExW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"SetConsoleTitleW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetVolumeInformationW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"SearchPathW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"WriteFile\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GlobalAlloc\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GlobalFree\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"SetFilePointerEx\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"SetConsoleCtrlHandler\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"EnterCriticalSection\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"TryAcquireSRWLockExclusive\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"ExpandEnvironmentStringsW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetModuleFileNameW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"LeaveCriticalSection\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"InitializeCriticalSection\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetVersion\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"ReleaseSRWLockExclusive\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetWindowsDirectoryW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetFileAttributesExW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetDriveTypeW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetCurrentThreadId\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"HeapSetInformation\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"OpenThread\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"VirtualFree\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"VirtualAlloc\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"HeapSize\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"HeapReAlloc\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"DuplicateHandle\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"FlushFileBuffers\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetACP\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"FormatMessageW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"SetConsoleTextAttribute\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"ScrollConsoleScreenBufferW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"FillConsoleOutputAttribute\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"CreateDirectoryW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"SetFileTime\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"SetEndOfFile\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"SetFileAttributesW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"DeleteFileW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"TerminateProcess\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"WaitForSingleObject\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"SetCurrentDirectoryW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetExitCodeProcess\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetCurrentDirectoryW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetFileInformationByHandleEx\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"RemoveDirectoryW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"CompareFileTime\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"DeviceIoControl\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetFileSecurityW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetSecurityDescriptorOwner\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetDiskFreeSpaceExW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"FindFirstFileExW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"ResumeThread\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetThreadGroupAffinity\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetNumaNodeProcessorMaskEx\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetThreadLocale\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"CreateHardLinkW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetVolumePathNameW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"CreateSymbolicLinkW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"Sleep\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"UnhandledExceptionFilter\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"SetUnhandledExceptionFilter\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetCurrentProcess\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"QueryPerformanceCounter\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetCurrentProcessId\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetSystemTimeAsFileTime\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetTickCount\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"lstrcmpiW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"lstrcmpW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"SetProcessAffinityMask\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"NtOpenProcessToken\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"NtQueryInformationToken\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"NtClose\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"NtOpenThreadToken\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"DelayLoadFailureHook\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"Beep\"; Source: \"00000000-00004716.00000000.77972.48F50000.00000002.mdmp, 00000000-00004716.00000001.79890.48F50000.00000002.mdmp, 00000000-00004716.00000002.81813.48F50000.00000002.mdmp\")\n Found reference to API (Indicator: \"SetConsoleInputExeNameW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"IsDebuggerPresent\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"CopyFileExW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"SetThreadUILanguage\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"NtQueryInformationProcess\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"RtlCreateUnicodeStringFromAsciiz\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"RtlNtStatusToDosError\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"NtSetInformationProcess\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"RtlFreeUnicodeString\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"RtlDosPathNameToRelativeNtPathName_U_WithStatus\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"NtSetInformationFile\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"RtlReleaseRelativeName\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"NtQueryVolumeInformationFile\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"NtOpenFile\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"RtlFindLeastSignificantBit\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"RtlDosPathNameToNtPathName_U\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"NtFsControlFile\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"RtlFreeHeap\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"RtlCaptureContext\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"RtlLookupFunctionEntry\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"RtlVirtualUnwind\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"CopyFileW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"ReadFile\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"SetThreadLocale\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"FindFirstFileW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetConsoleScreenBufferInfo\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"HeapFree\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetFullPathNameW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"FindNextFileW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetConsoleOutputCP\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetStdHandle\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetCPInfo\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"SetFilePointer\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"FindClose\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"CreateFileW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"MultiByteToWideChar\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetLastError\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"FillConsoleOutputCharacterW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"ReadConsoleW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"CloseHandle\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"ReleaseSRWLockShared\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"HeapAlloc\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"FlushConsoleInputBuffer\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"WriteConsoleW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetProcAddress\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"AcquireSRWLockShared\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetFileSize\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetProcessHeap\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetModuleHandleW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"WideCharToMultiByte\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetFileType\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"SetConsoleCursorPosition\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"RevertToSelf\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"VirtualQuery\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"SetLocalTime\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetLocaleInfoW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetUserDefaultLCID\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"FileTimeToSystemTime\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"FileTimeToLocalFileTime\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetLocalTime\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetTimeFormatW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"SystemTimeToFileTime\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetSystemTime\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetDateFormatW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetNumaHighestNodeNumber\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetCommandLineW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"SetConsoleMode\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"SetEnvironmentVariableW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetEnvironmentVariableW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"FreeEnvironmentStringsW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetConsoleMode\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"SetEnvironmentStringsW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetEnvironmentStringsW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetStartupInfoW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"RegQueryValueExW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"NeedCurrentDirectoryForExePathW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"SetLastError\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"RegDeleteValueW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"InitializeProcThreadAttributeList\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"CreateProcessAsUserW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"RegOpenKeyExW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"SetErrorMode\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetConsoleTitleW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetFileAttributesW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"RegSetValueExW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"RegEnumKeyExW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"UpdateProcThreadAttribute\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"RegCreateKeyExW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"DeleteProcThreadAttributeList\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"ReadProcessMemory\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"CreateProcessW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"RegDeleteKeyExW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"RegCloseKey\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"LoadLibraryExW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"MoveFileWithProgressW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"LocalFree\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"MoveFileExW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"SetConsoleTitleW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetVolumeInformationW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"SearchPathW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"WriteFile\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GlobalAlloc\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GlobalFree\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"SetFilePointerEx\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"SetConsoleCtrlHandler\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"EnterCriticalSection\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"TryAcquireSRWLockExclusive\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"ExpandEnvironmentStringsW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetModuleFileNameW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"LeaveCriticalSection\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"InitializeCriticalSection\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetVersion\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"ReleaseSRWLockExclusive\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetWindowsDirectoryW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetFileAttributesExW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetDriveTypeW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetCurrentThreadId\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"HeapSetInformation\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"OpenThread\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"VirtualFree\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"VirtualAlloc\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"HeapSize\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"HeapReAlloc\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"DuplicateHandle\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"FlushFileBuffers\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetACP\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"FormatMessageW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"SetConsoleTextAttribute\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"ScrollConsoleScreenBufferW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"FillConsoleOutputAttribute\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"CreateDirectoryW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"SetFileTime\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"SetEndOfFile\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"SetFileAttributesW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"DeleteFileW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"TerminateProcess\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"SetCurrentDirectoryW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetExitCodeProcess\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetCurrentDirectoryW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetFileInformationByHandleEx\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"RemoveDirectoryW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"CompareFileTime\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"DeviceIoControl\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetFileSecurityW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetSecurityDescriptorOwner\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetDiskFreeSpaceExW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"FindFirstFileExW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"ResumeThread\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetThreadGroupAffinity\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetNumaNodeProcessorMaskEx\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetThreadLocale\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"CreateHardLinkW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetVolumePathNameW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"CreateSymbolicLinkW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"Sleep\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"UnhandledExceptionFilter\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"SetUnhandledExceptionFilter\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetCurrentProcessId\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetTickCount\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"lstrcmpiW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"lstrcmpW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"SetProcessAffinityMask\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"NtOpenProcessToken\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"NtQueryInformationToken\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"NtClose\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"NtOpenThreadToken\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"DelayLoadFailureHook\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
"origin": "File/Memory",
"attck_id": "T1106",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1106"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "General",
"identifier": "string-7",
"type": 2,
"relevance": 1,
"name": "Contains PDB pathways",
"description": "\"cmd.pdb\"",
"origin": "File/Memory",
"attck_id": null,
"capec_id": null,
"attck_id_wiki": null
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "General",
"identifier": "string-240",
"type": 2,
"relevance": 1,
"name": "Contains ability to execute an application (API string)",
"description": "Found reference to API \"ShellExecuteWorker\" (Indicator: \"ShellExecute\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"ShellExecuteWorker\" (Indicator: \"ShellExecute\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
"origin": "File/Memory",
"attck_id": "T1106",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1106"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "General",
"identifier": "string-315",
"type": 2,
"relevance": 1,
"name": "Contains ability to create/open files (API string)",
"description": "Found reference to API \"NtOpenFile\" (Indicator: \"NtOpenFile\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"NtOpenFile\" (Indicator: \"NtOpenFile\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
"origin": "File/Memory",
"attck_id": "T1106",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1106"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "General",
"identifier": "string-220",
"type": 2,
"relevance": 1,
"name": "Contains ability to create/control drivers (API string)",
"description": "Found reference to API \"NtFsControlFile\" (Indicator: \"FsControlFile\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"NtFsControlFile\" (Indicator: \"FsControlFile\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
"origin": "File/Memory",
"attck_id": "T1543.003",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1543/003"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "General",
"identifier": "string-319",
"type": 2,
"relevance": 1,
"name": "Contains ability to set/get the last-error code for a calling thread (API string)",
"description": "Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
"origin": "File/Memory",
"attck_id": "T1106",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1106"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "General",
"identifier": "string-272",
"type": 2,
"relevance": 1,
"name": "Contains ability to retrieve/open a process (API string)",
"description": "Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
"origin": "File/Memory",
"attck_id": "T1057",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1057"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "General",
"identifier": "string-206",
"type": 2,
"relevance": 1,
"name": "Contains ability to retrieve the command-line string for the current process (API string)",
"description": "Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
"origin": "File/Memory",
"attck_id": "T1059.003",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1059/003"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "General",
"identifier": "string-204",
"type": 2,
"relevance": 1,
"name": "Contains ability to create a new process (API string)",
"description": "Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcess\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
"origin": "File/Memory",
"attck_id": "T1106",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1106"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "General",
"identifier": "string-307",
"type": 2,
"relevance": 1,
"name": "Contains ability to create/load registry keys (API string)",
"description": "Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
"origin": "File/Memory",
"attck_id": "T1112",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1112"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "General",
"identifier": "string-345",
"type": 2,
"relevance": 1,
"name": "Contains ability to disable/close registry key (API string)",
"description": "Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
"origin": "File/Memory",
"attck_id": "T1112",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1112"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "General",
"identifier": "string-322",
"type": 2,
"relevance": 1,
"name": "Contains ability to move file or directory (API string)",
"description": "Found reference to API \"MoveFileWithProgressW\" (Indicator: \"MoveFile\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"MoveFileWithProgressW\" (Indicator: \"MoveFile\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
"origin": "File/Memory",
"attck_id": "T1570",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1570"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "General",
"identifier": "string-161",
"type": 2,
"relevance": 1,
"name": "Contains ability to retrieve/modify process thread (API string)",
"description": "Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"NtOpenThreadToken\" (Indicator: \"OpenThread\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"NtOpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
"origin": "File/Memory",
"attck_id": "T1106",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1106"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "General",
"identifier": "string-423",
"type": 2,
"relevance": 1,
"name": "Contains ability to create directories (API string)",
"description": "Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
"origin": "File/Memory",
"attck_id": "T1074.001",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1074/001"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "General",
"identifier": "string-120",
"type": 2,
"relevance": 1,
"name": "Contains registry location strings",
"description": "\"Software\\Microsoft\\Command Processor\" in Source: 935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\n \"Software\\Policies\\Microsoft\\Windows\\System\" in Source: 935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\n \"Software\\Classes\" in Source: 935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\n \"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Keyboard Layout\" in Source: 00000000-00004716.00000000.77972.48F50000.00000002.mdmp\n 00000000-00004716.00000001.79890.48F50000.00000002.mdmp\n 00000000-00004716.00000002.81813.48F50000.00000002.mdmp\n \"Software\\Microsoft\\RegEdt32\" in Source: 00000000-00004716.00000000.77972.48F50000.00000002.mdmp\n 00000000-00004716.00000001.79890.48F50000.00000002.mdmp\n 00000000-00004716.00000002.81813.48F50000.00000002.mdmp\n \"SOFTWARE\\\\MICROSOFT\\\\CLOCK\" in Source: 00000000-00004716.00000000.77972.48F50000.00000002.mdmp\n 00000000-00004716.00000001.79890.48F50000.00000002.mdmp\n 00000000-00004716.00000002.81813.48F50000.00000002.mdmp\n \"Software\\Microsoft\\Windows NT\\CurrentVersion\\Devices\" in Source: 00000000-00004716.00000000.77972.48F50000.00000002.mdmp\n 00000000-00004716.00000001.79890.48F50000.00000002.mdmp\n 00000000-00004716.00000002.81813.48F50000.00000002.mdmp\n \"SOFTWARE\\\\MICROSOFT\\\\WINDOWS NT\\\\CURRENTVERSION\\\\EXTENSIONS\" in Source: 00000000-00004716.00000000.77972.48F50000.00000002.mdmp\n 00000000-00004716.00000001.79890.48F50000.00000002.mdmp\n 00000000-00004716.00000002.81813.48F50000.00000002.mdmp\n \"SOFTWARE\\\\MICROSOFT\\\\CHARMAP\" in Source: 00000000-00004716.00000000.77972.48F50000.00000002.mdmp\n 00000000-00004716.00000001.79890.48F50000.00000002.mdmp\n 00000000-00004716.00000002.81813.48F50000.00000002.mdmp\n \"SOFTWARE\\\\MICROSOFT\\\\WINDOWS NT\\\\CURRENTVERSION\\\\NETWORK\\\\PERSISTENT CONNECTIONS\" in Source: 00000000-00004716.00000000.77972.48F50000.00000002.mdmp\n 00000000-00004716.00000001.79890.48F50000.00000002.mdmp\n 00000000-00004716.00000002.81813.48F50000.00000002.mdmp\n \"Software\\Microsoft\\Windows NT\\CurrentVersion\\PrinterPorts\" in Source: 00000000-00004716.00000000.77972.48F50000.00000002.mdmp\n 00000000-00004716.00000001.79890.48F50000.00000002.mdmp\n 00000000-00004716.00000002.81813.48F50000.00000002.mdmp\n \"SOFTWARE\\\\MICROSOFT\\\\WINDOWS NT\\\\CURRENTVERSION\\\\TRUETYPE\" in Source: 00000000-00004716.00000000.77972.48F50000.00000002.mdmp\n 00000000-00004716.00000001.79890.48F50000.00000002.mdmp\n 00000000-00004716.00000002.81813.48F50000.00000002.mdmp\n \"SOFTWARE\\\\MICROSOFT\\\\WINDOWS NT\\\\CURRENTVERSION\\\\TWAIN\" in Source: 00000000-00004716.00000000.77972.48F50000.00000002.mdmp\n 00000000-00004716.00000001.79890.48F50000.00000002.mdmp\n 00000000-00004716.00000002.81813.48F50000.00000002.mdmp\n \"SOFTWARE\\\\MICROSOFT\\\\WINDOWS HELP\" in Source: 00000000-00004716.00000000.77972.48F50000.00000002.mdmp\n 00000000-00004716.00000001.79890.48F50000.00000002.mdmp\n 00000000-00004716.00000002.81813.48F50000.00000002.mdmp\n \"Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\" in Source: 00000000-00004716.00000000.77972.48F50000.00000002.mdmp\n 00000000-00004716.00000001.79890.48F50000.00000002.mdmp\n 00000000-00004716.00000002.81813.48F50000.00000002.mdmp\n \"Software\\Microsoft\\Command Processor\" in Source: 00000000-00004716.00000000.77972.49307000.00000002.mdmp\n 00000000-00004716.00000001.79890.49307000.00000002.mdmp\n 00000000-00004716.00000002.81813.49307000.00000002.mdmp\n \"Software\\Policies\\Microsoft\\Windows\\System\" in Source: 00000000-00004716.00000000.77972.49307000.00000002.mdmp\n 00000000-00004716.00000001.79890.49307000.00000002.mdmp\n 00000000-00004716.00000002.81813.49307000.00000002.mdmp\n \"Software\\Classes\" in Source: 00000000-00004716.00000000.77972.49307000.00000002.mdmp\n 00000000-00004716.00000001.79890.49307000.00000002.mdmp\n 00000000-00004716.00000002.81813.49307000.00000002.mdmp",
"origin": "File/Memory",
"attck_id": "T1012",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1012"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "General",
"identifier": "static-157",
"type": 0,
"relevance": 0,
"name": "Matched Compiler/Packer signature (DIE)",
"description": "\"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\" was detected as \"Microsoft Linker\" and name: \"Linker\"",
"origin": "Static Parser",
"attck_id": "T1027",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1027"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "General",
"identifier": "static-93",
"type": 0,
"relevance": 1,
"name": "PE file has a high image base",
"description": "\"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\" has high imagebase \"0x140000000\"",
"origin": "Static Parser",
"attck_id": null,
"capec_id": null,
"attck_id_wiki": null
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "General",
"identifier": "static-154",
"type": 0,
"relevance": 0,
"name": "File contains dynamic base/NX flags",
"description": "\"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA",
"origin": "Static Parser",
"attck_id": null,
"capec_id": null,
"attck_id_wiki": null
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "General",
"identifier": "static-96",
"type": 0,
"relevance": 0,
"name": "PE file entrypoint instructions",
"description": "\"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\" file has an entrypoint instructions - \"sub\trsp, 0x28,call\t0x1400156b4,add\trsp, 0x28,jmp\t0x140014fc0,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,nop\tword ptr [rax + rax],cmp\trcx, qword ptr [rip + 0x19e41],jne\t0x1400151d9,rol\trcx, 0x10,test\tcx, 0xffff,jne\t0x1400151d5,ret\t,ror\trcx, 0x10,jmp\t0x140015220,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,push\trbx,sub\trsp, 0x20,mov\trbx, rcx,xor\tecx, ecx,\"",
"origin": "Static Parser",
"attck_id": null,
"capec_id": null,
"attck_id_wiki": null
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "General",
"identifier": "static-80",
"type": 0,
"relevance": 1,
"name": "PE file contains executable sections",
"description": "\"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\" has an executable section named \".text\"",
"origin": "Static Parser",
"attck_id": null,
"capec_id": null,
"attck_id_wiki": null
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "General",
"identifier": "static-95",
"type": 0,
"relevance": 0,
"name": "PE file contains writable sections",
"description": "\"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\" has an writable section named \".data\"\n \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\" has an writable section named \".didat\"",
"origin": "Static Parser",
"attck_id": null,
"capec_id": null,
"attck_id_wiki": null
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "General",
"identifier": "static-146",
"type": 0,
"relevance": 0,
"name": "PE file contains Debug data directory",
"description": "\"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"",
"origin": "Static Parser",
"attck_id": null,
"capec_id": null,
"attck_id_wiki": null
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "General",
"identifier": "stream-103",
"type": 1,
"relevance": 3,
"name": "Contains ability to delay the execution of current thread",
"description": "Sleep at 61526-1-0000000140015190",
"origin": "Hybrid Analysis Technology",
"attck_id": "T1497.003",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1497/003"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "General",
"identifier": "string-625",
"type": 2,
"relevance": 1,
"name": "References Windows filepaths for DLLs (possible dropped files)",
"description": "Observed system executable string:\"C:\\windows\\temp\\VxSSL64.dll\" [Source: 00000000-00004716.00000000.77972.67BF0000.00000020.mdmp\n 00000000-00004716.00000001.79890.67BF0000.00000020.mdmp\n 00000000-00004716.00000002.81813.67BF0000.00000020.mdmp]\n Observed system executable string:\"C:\\WINDOWS\\system32\\sxsoa.dll\" [Source: 00000000-00004716.00000000.77972.67C20000.00000002.mdmp\n 00000000-00004716.00000001.79890.67C20000.00000002.mdmp\n 00000000-00004716.00000002.81813.67C20000.00000002.mdmp]\n Observed system executable string:\"C:\\WINDOWS\\system32\\GdiPlus.dll\" [Source: 00000000-00004716.00000000.77972.67C20000.00000002.mdmp\n 00000000-00004716.00000001.79890.67C20000.00000002.mdmp\n 00000000-00004716.00000002.81813.67C20000.00000002.mdmp]\n Observed system executable string:\"C:\\WINDOWS\\system32\\comctl32.dll\" [Source: 00000000-00004716.00000000.77972.67C20000.00000002.mdmp\n 00000000-00004716.00000001.79890.67C20000.00000002.mdmp\n 00000000-00004716.00000002.81813.67C20000.00000002.mdmp]\n Observed system executable string:\"C:\\WINDOWS\\system32\\sxsoaps.dll\" [Source: 00000000-00004716.00000000.77972.67C20000.00000002.mdmp\n 00000000-00004716.00000001.79890.67C20000.00000002.mdmp\n 00000000-00004716.00000002.81813.67C20000.00000002.mdmp]\n Observed system executable string:\"C:\\WINDOWS\\system32\\comctl32.dll.mui\" [Source: 00000000-00004716.00000000.77972.67C20000.00000002.mdmp\n 00000000-00004716.00000001.79890.67C20000.00000002.mdmp\n 00000000-00004716.00000002.81813.67C20000.00000002.mdmp]\n Observed system executable string:\":\\WINDOWS\\SYSTEM32\\ntdll.dll\" [Source: 00000000-00004716.00000000.77972.69D30000.00000004.mdmp\n 00000000-00004716.00000001.79890.69D30000.00000004.mdmp\n 00000000-00004716.00000002.81813.69D30000.00000004.mdmp]\n Observed system executable string:\":\\WINDOWS\\System32\\KERNEL32.DLL\" [Source: 00000000-00004716.00000000.77972.69D30000.00000004.mdmp\n 00000000-00004716.00000001.79890.69D30000.00000004.mdmp\n 00000000-00004716.00000002.81813.69D30000.00000004.mdmp]\n Observed system executable string:\":\\WINDOWS\\System32\\msvcrt.dll\" [Source: 00000000-00004716.00000000.77972.69D30000.00000004.mdmp\n 00000000-00004716.00000001.79890.69D30000.00000004.mdmp\n 00000000-00004716.00000002.81813.69D30000.00000004.mdmp]\n Observed system executable string:\":\\WINDOWS\\System32\\KERNELBASE.dll\" [Source: 00000000-00004716.00000000.77972.69D30000.00000004.mdmp\n 00000000-00004716.00000001.79890.69D30000.00000004.mdmp\n 00000000-00004716.00000002.81813.69D30000.00000004.mdmp]\n Observed system executable string:\":\\windows\\temp\\VxSSL64.dll\" [Source: 00000000-00004716.00000000.77972.69D30000.00000004.mdmp\n 00000000-00004716.00000001.79890.69D30000.00000004.mdmp\n 00000000-00004716.00000002.81813.69D30000.00000004.mdmp]\n Observed system executable string:\":\\WINDOWS\\System32\\WS2_32.dll\" [Source: 00000000-00004716.00000000.77972.69D30000.00000004.mdmp\n 00000000-00004716.00000001.79890.69D30000.00000004.mdmp\n 00000000-00004716.00000002.81813.69D30000.00000004.mdmp]\n Observed system executable string:\"C:\\windows\\temp\\VxOle64.dll\" [Source: 00000000-00004716.00000000.77972.69D30000.00000004.mdmp\n 00000000-00004716.00000000.77972.69E40000.00000020.mdmp\n 00000000-00004716.00000000.77972.69E70000.00000002.mdmp\n 00000000-00004716.00000001.79890.69D30000.00000004.mdmp\n 00000000-00004716.00000001.79890.69E40000.00000020.mdmp\n 00000000-00004716.00000001.79890.69E70000.00000002.mdmp\n 00000000-00004716.00000002.81813.69D30000.00000004.mdmp\n 00000000-00004716.00000002.81813.69E40000.00000020.mdmp\n 00000000-00004716.00000002.81813.69E70000.00000002.mdmp]\n Observed system executable string:\":\\WINDOWS\\System32\\RPCRT4.dll\" [Source: 00000000-00004716.00000000.77972.69D30000.00000004.mdmp\n 00000000-00004716.00000001.79890.69D30000.00000004.mdmp\n 00000000-00004716.00000002.81813.69D30000.00000004.mdmp]\n Observed system executable string:\":\\WINDOWS\\SYSTEM32\\FLTLIB.DLL\" [Source: 00000000-00004716.00000000.77972.69D30000.00000004.mdmp\n 00000000-00004716.00000001.79890.69D30000.00000004.mdmp\n 00000000-00004716.00000002.81813.69D30000.00000004.mdmp]\n Observed system executable string:\"C:\\WINDOWS\\SYSTEM32\\gdi32full.dll\" [Source: 00000000-00004716.00000000.77972.69D30000.00000004.mdmp\n 00000000-00004716.00000001.79890.69D30000.00000004.mdmp\n 00000000-00004716.00000002.81813.69D30000.00000004.mdmp]\n Observed system executable string:\":\\WINDOWS\\System32\\ucrtbase.dll\" [Source: 00000000-00004716.00000000.77972.69D30000.00000004.mdmp\n 00000000-00004716.00000001.79890.69D30000.00000004.mdmp\n 00000000-00004716.00000002.81813.69D30000.00000004.mdmp]\n Observed system executable string:\":\\WINDOWS\\System32\\USER32.dll\" [Source: 00000000-00004716.00000000.77972.69D30000.00000004.mdmp\n 00000000-00004716.00000001.79890.69D30000.00000004.mdmp\n 00000000-00004716.00000002.81813.69D30000.00000004.mdmp]\n Observed system executable string:\":\\WINDOWS\\System32\\ADVAPI32.dll\" [Source: 00000000-00004716.00000000.77972.69D30000.00000004.mdmp\n 00000000-00004716.00000001.79890.69D30000.00000004.mdmp\n 00000000-00004716.00000002.81813.69D30000.00000004.mdmp]\n Observed system executable string:\":\\WINDOWS\\System32\\ole32.dll\" [Source: 00000000-00004716.00000000.77972.69D30000.00000004.mdmp\n 00000000-00004716.00000001.79890.69D30000.00000004.mdmp\n 00000000-00004716.00000002.81813.69D30000.00000004.mdmp]\n Observed system executable string:\":\\WINDOWS\\System32\\GDI32.dll\" [Source: 00000000-00004716.00000000.77972.69D30000.00000004.mdmp\n 00000000-00004716.00000001.79890.69D30000.00000004.mdmp\n 00000000-00004716.00000002.81813.69D30000.00000004.mdmp]\n Observed system executable string:\":\\WINDOWS\\System32\\gdi32full.dll\" [Source: 00000000-00004716.00000000.77972.69D30000.00000004.mdmp\n 00000000-00004716.00000001.79890.69D30000.00000004.mdmp\n 00000000-00004716.00000002.81813.69D30000.00000004.mdmp]\n Observed system executable string:\":\\WINDOWS\\System32\\combase.dll\" [Source: 00000000-00004716.00000000.77972.69D30000.00000004.mdmp\n 00000000-00004716.00000001.79890.69D30000.00000004.mdmp\n 00000000-00004716.00000002.81813.69D30000.00000004.mdmp]\n Observed system executable string:\":\\WINDOWS\\System32\\msvcp_win.dll\" [Source: 00000000-00004716.00000000.77972.69D30000.00000004.mdmp\n 00000000-00004716.00000001.79890.69D30000.00000004.mdmp\n 00000000-00004716.00000002.81813.69D30000.00000004.mdmp]\n Observed system executable string:\":\\WINDOWS\\System32\\sechost.dll\" [Source: 00000000-00004716.00000000.77972.69D30000.00000004.mdmp\n 00000000-00004716.00000001.79890.69D30000.00000004.mdmp\n 00000000-00004716.00000002.81813.69D30000.00000004.mdmp]",
"origin": "File/Memory",
"attck_id": "T1083",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1083"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "Unusual Characteristics",
"identifier": "registry-26",
"type": 3,
"relevance": 2,
"name": "Reads the windows installation language",
"description": "\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")",
"origin": "Registry Access",
"attck_id": "T1614.001",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1614/001"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "Installation/Persistence",
"identifier": "api-126",
"type": 6,
"relevance": 3,
"name": "Tries to access non-existent files (executable)",
"description": "\"cmd.exe\" trying to access non-existent file \"C:\\FLTLIB.DLL\"\n \"cmd.exe\" trying to access non-existent file \"C:\\NETMSG.DLL\"\n \"cmd.exe\" trying to access non-existent file \"C:\\netmsg.dll\"",
"origin": "API Call",
"attck_id": "T1083",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1083"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "Installation/Persistence",
"identifier": "api-263",
"type": 6,
"relevance": 1,
"name": "Touches files",
"description": "\"cmd.exe\" trying to touch file \"C:\\FLTLIB.DLL\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\fltLib.dll\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"cmd.exe\" trying to touch file \"C:\\windows\\temp\\VxOle64.dll\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"\n \"cmd.exe\" trying to touch file \"C:\\WINDOWS\\system32\\IMM32.DLL\"\n \"cmd.exe\" trying to touch file \"C:\\EN-US\\CMD.EXE.MUI\"\n \"cmd.exe\" trying to touch file \"C:\\EN\\CMD.EXE.MUI\"\n \"cmd.exe\" trying to touch file \"C:\\cmd.exe\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\oleaut32.dll\"",
"origin": "API Call",
"attck_id": "T1083",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1083"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "Installation/Persistence",
"identifier": "api-235",
"type": 6,
"relevance": 1,
"name": "Queries basic information of the specified process",
"description": "\"cmd.exe\" queries basic process information of the \"C:\\cmd.exe\" (UID: 4716)",
"origin": "API Call",
"attck_id": "T1057",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1057"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "Installation/Persistence",
"identifier": "registry-177",
"type": 3,
"relevance": 1,
"name": "Opens registry keys",
"description": "\"cmd.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\\SEGMENT HEAP\"; Key: \"\"; Value: \"\")\n \"cmd.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\"; Key: \"\"; Value: \"\")\n \"cmd.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\IMAGE FILE EXECUTION OPTIONS\\CONHOST.EXE\"; Key: \"\"; Value: \"\")\n \"cmd.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\"; Value: \"\")\n \"cmd.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\\BAM\"; Key: \"\"; Value: \"\")\n \"cmd.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SAFEBOOT\\OPTION\"; Key: \"\"; Value: \"\")\n \"cmd.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SRP\\GP\\DLL\"; Key: \"\"; Value: \"\")\n \"cmd.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"\"; Value: \"\")\n \"cmd.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"\"; Value: \"\")\n \"cmd.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\FILESYSTEM\"; Key: \"\"; Value: \"\")\n \"cmd.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\SORTING\\VERSIONS\"; Key: \"\"; Value: \"\")\n \"cmd.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\\MUICACHED\\MACHINELANGUAGECONFIGURATION\"; Key: \"\"; Value: \"\")\n \"cmd.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\MUI\\SETTINGS\"; Key: \"\"; Value: \"\")\n \"cmd.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\CONTROL PANEL\\DESKTOP\"; Key: \"\"; Value: \"\")\n \"cmd.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\\LANGUAGECONFIGURATION\"; Key: \"\"; Value: \"\")",
"origin": "Registry Access",
"attck_id": "T1012",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1012"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "Installation/Persistence",
"identifier": "registry-172",
"type": 3,
"relevance": 1,
"name": "Queries registry keys",
"description": "\"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\"; Key: \"RESOURCEPOLICIES\"; Value: \"\")\n \"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CONHOST.EXE\"; Value: \"\")\n \"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\"; Value: \"\")\n \"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\FILESYSTEM\"; Key: \"LONGPATHSENABLED\"; Value: \"\")\n \"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\SORTING\\VERSIONS\"; Key: \"\"; Value: \"\")\n \"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\"; Key: \"PREFERREDUILANGUAGES\"; Value: \"\")\n \"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\\MUICACHED\"; Key: \"MACHINEPREFERREDUILANGUAGES\"; Value: \"\")\n \"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\SIDEBYSIDE\"; Key: \"PREFEREXTERNALMANIFEST\"; Value: \"\")\n \"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\"; Key: \"SAFEDLLSEARCHMODE\"; Value: \"\")\n \"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\LSA\\FIPSALGORITHMPOLICY\"; Key: \"ENABLED\"; Value: \"\")\n \"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\LSA\"; Key: \"FIPSALGORITHMPOLICY\"; Value: \"\")\n \"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\LSA\\FIPSALGORITHMPOLICY\"; Key: \"MDMENABLED\"; Value: \"\")\n \"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\OLE\"; Key: \"PAGEALLOCATORUSESYSTEMHEAP\"; Value: \"\")\n \"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\OLE\"; Key: \"PAGEALLOCATORSYSTEMHEAPISPRIVATE\"; Value: \"\")\n \"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\OLE\"; Key: \"AGGRESSIVEMTATESTING\"; Value: \"\")\n \"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\GRE_INITIALIZE\"; Key: \"DISABLEMETAFILES\"; Value: \"\")\n \"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\"; Key: \"ENABLEPERPROCESSSYSTEMDPI\"; Value: \"\")\n \"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\COMPATIBILITY32\"; Key: \"CMD\"; Value: \"\")\n \"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CMF\\CONFIG\"; Key: \"SYSTEM\"; Value: \"\")\n \"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\WINDOWS\"; Key: \"LOADAPPINIT_DLLS\"; Value: \"\")\n \"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SYSTEM\"; Key: \"DISABLECMD\"; Value: \"\")",
"origin": "Registry Access",
"attck_id": "T1012",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1012"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "Installation/Persistence",
"identifier": "string-310",
"type": 2,
"relevance": 1,
"name": "Contains ability to load modules (API string)",
"description": "Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
"origin": "File/Memory",
"attck_id": "T1106",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1106"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "Installation/Persistence",
"identifier": "string-443",
"type": 2,
"relevance": 1,
"name": "Contains registry location which perform auto-execute functionality",
"description": "Found string \"Software\\Microsoft\\Command Processor\" (Indicator: \"software\\microsoft\\command processor\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found string \"Software\\Microsoft\\Command Processor\" (Indicator: \"software\\microsoft\\command processor\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
"origin": "File/Memory",
"attck_id": "T1547.001",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1547/001"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "Anti-Detection/Stealthyness",
"identifier": "string-304",
"type": 2,
"relevance": 1,
"name": "Contains ability to modify registry key/value (API string)",
"description": "Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
"origin": "File/Memory",
"attck_id": "T1112",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1112"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "Anti-Detection/Stealthyness",
"identifier": "string-318",
"type": 2,
"relevance": 1,
"name": "Contains ability to load/free library (API string)",
"description": "Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
"origin": "File/Memory",
"attck_id": "T1055.001",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1055/001"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "Anti-Detection/Stealthyness",
"identifier": "string-92",
"type": 2,
"relevance": 1,
"name": "Contains ability to inject code into another process (API string)",
"description": "Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
"origin": "File/Memory",
"attck_id": "T1055",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1055"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "Anti-Detection/Stealthyness",
"identifier": "string-409",
"type": 2,
"relevance": 1,
"name": "Contains ability to set file time (API string)",
"description": "Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
"origin": "File/Memory",
"attck_id": "T1070.006",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1070/006"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "Anti-Detection/Stealthyness",
"identifier": "string-226",
"type": 2,
"relevance": 1,
"name": "Contains ability to delay execution by waiting for signal/timeout (API string)",
"description": "Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
"origin": "File/Memory",
"attck_id": null,
"capec_id": null,
"attck_id_wiki": null
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "Anti-Detection/Stealthyness",
"identifier": "string-306",
"type": 2,
"relevance": 1,
"name": "Contains ability to impersonate access tokens (API string)",
"description": "Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"NtOpenThreadToken\" (Indicator: \"OpenThreadToken\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"NtOpenThreadToken\" (Indicator: \"OpenThreadToken\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
"origin": "File/Memory",
"attck_id": "T1134.001",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1134/001"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "Anti-Detection/Stealthyness",
"identifier": "memorydump-8",
"type": 20,
"relevance": 1,
"name": "Found PE header in memory",
"description": "Found PE header \"MZ\" - Source: \"00000000-00004716.00000000.77972.492E0000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00004716.00000001.79890.492E0000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00004716.00000002.81813.492E0000.00000002.mdmp\")",
"origin": "Memory Dumps",
"attck_id": "T1055",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1055"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "Anti-Reverse Engineering",
"identifier": "string-183",
"type": 2,
"relevance": 1,
"name": "Contains ability to check debugger is running (API string)",
"description": "Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"NtQueryInformationProcess\" (Indicator: \"NtQueryInformationProcess\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")",
"origin": "File/Memory",
"attck_id": "T1622",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1622"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "Anti-Reverse Engineering",
"identifier": "string-148",
"type": 2,
"relevance": 1,
"name": "Contains ability to register a top-level exception handler (API string)",
"description": "Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")",
"origin": "File/Memory",
"attck_id": "T1622",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1622"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "Environment Awareness",
"identifier": "registry-78",
"type": 3,
"relevance": 1,
"name": "Contains ability to read software policies",
"description": "\"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")",
"origin": "Registry Access",
"attck_id": "T1082",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1082"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "Environment Awareness",
"identifier": "string-222",
"type": 2,
"relevance": 1,
"name": "Contains ability to retrieve network parameters of a computer (API string)",
"description": "Found reference to API \"WNetGetConnectionWStub\" (Indicator: \"NetGetConnection\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"WNetGetConnectionWStub\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
"origin": "File/Memory",
"attck_id": "T1016",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1016"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "Environment Awareness",
"identifier": "string-89",
"type": 2,
"relevance": 1,
"name": "Contains ability to retrieve information about the current system (API string)",
"description": "Found reference to API \"RtlNtStatusToDosError\" (Indicator: \"RtlNtStatusToDosError\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"ExpandEnvironmentStringsW\" (Indicator: \"ExpandEnvironmentStrings\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"RtlNtStatusToDosError\" (Indicator: \"RtlNtStatusToDosError\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"ExpandEnvironmentStringsW\" (Indicator: \"ExpandEnvironmentStrings\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
"origin": "File/Memory",
"attck_id": "T1082",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1082"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "Environment Awareness",
"identifier": "string-162",
"type": 2,
"relevance": 1,
"name": "Contains ability to retrieve volume information (API string)",
"description": "Found reference to API \"NtQueryVolumeInformationFile\" (Indicator: \"NtQueryVolumeInformationFile\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"NtQueryVolumeInformationFile\" (Indicator: \"NtQueryVolumeInformationFile\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
"origin": "File/Memory",
"attck_id": "T1082",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1082"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "Environment Awareness",
"identifier": "string-201",
"type": 2,
"relevance": 1,
"name": "Contains ability to query system locale (API string)",
"description": "Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
"origin": "File/Memory",
"attck_id": "T1614",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1614"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "Environment Awareness",
"identifier": "string-249",
"type": 2,
"relevance": 1,
"name": "Contains ability to retrieve file time (API string)",
"description": "Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"FileTimeToLocalFileTime\" (Indicator: \"FileTimeToLocalFileTime\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"FileTimeToLocalFileTime\" (Indicator: \"FileTimeToLocalFileTime\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
"origin": "File/Memory",
"attck_id": "T1070.006",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1070/006"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "Environment Awareness",
"identifier": "string-365",
"type": 2,
"relevance": 1,
"name": "Contains ability to perform scheduled transfer (API string)",
"description": "Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
"origin": "File/Memory",
"attck_id": "T1029",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1029"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "Environment Awareness",
"identifier": "string-247",
"type": 2,
"relevance": 1,
"name": "Contains ability to retrieve machine time (API string)",
"description": "Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
"origin": "File/Memory",
"attck_id": "T1124",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1124"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "Environment Awareness",
"identifier": "string-167",
"type": 2,
"relevance": 1,
"name": "Contains ability to retrieve the contents of the STARTUPINFO structure (API string)",
"description": "Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")",
"origin": "File/Memory",
"attck_id": "T1543",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1543"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "Environment Awareness",
"identifier": "string-171",
"type": 2,
"relevance": 1,
"name": "Contains ability to retrieve the OS information (API string)",
"description": "Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
"origin": "File/Memory",
"attck_id": "T1082",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1082"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "Environment Awareness",
"identifier": "string-312",
"type": 2,
"relevance": 1,
"name": "Contains ability to retrieve path in which Windows is installed (API string)",
"description": "Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
"origin": "File/Memory",
"attck_id": "T1083",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1083"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "Environment Awareness",
"identifier": "string-193",
"type": 2,
"relevance": 1,
"name": "Contains ability to query volume/memory size (API string)",
"description": "Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
"origin": "File/Memory",
"attck_id": "T1082",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1082"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "Environment Awareness",
"identifier": "string-194",
"type": 2,
"relevance": 1,
"name": "Contains the ability to enumerate volumes (API string)",
"description": "Found reference to API \"GetVolumePathNameW\" (Indicator: \"GetVolumePathName\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetVolumePathNameW\" (Indicator: \"GetVolumePathName\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
"origin": "File/Memory",
"attck_id": "T1006",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1006"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "Spyware/Information Retrieval",
"identifier": "api-103",
"type": 6,
"relevance": 3,
"name": "Calls an API typically used for taking snapshot of the specified processes",
"description": "\"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}",
"origin": "API Call",
"attck_id": "T1057",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1057"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "Spyware/Information Retrieval",
"identifier": "string-85",
"type": 2,
"relevance": 1,
"name": "Contains ability to enumerate process and/or its information (API string)",
"description": "Found reference to API \"NtQueryInformationProcess\" (Indicator: \"QueryInformationProcess\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"NtQueryInformationProcess\" (Indicator: \"QueryInformationProcess\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
"origin": "File/Memory",
"attck_id": "T1057",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1057"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "Spyware/Information Retrieval",
"identifier": "string-121",
"type": 2,
"relevance": 1,
"name": "Contains ability to retrieve usernames and/or user information (API string)",
"description": "Found reference to API \"NtQueryInformationProcess\" (Indicator: \"NtQueryInformationProcess\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"LookupAccountSidWStub\" (Indicator: \"LookupAccountSid\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"NtOpenProcessToken\" (Indicator: \"NtOpenProcessToken\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"NtQueryInformationToken\" (Indicator: \"NtQueryInformationToken\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"NtOpenThreadToken\" (Indicator: \"NtOpenThreadToken\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"NtQueryInformationProcess\" (Indicator: \"NtQueryInformationProcess\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"LookupAccountSidWStub\" (Indicator: \"LookupAccountSid\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"NtOpenProcessToken\" (Indicator: \"NtOpenProcessToken\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"NtQueryInformationToken\" (Indicator: \"NtQueryInformationToken\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"NtOpenThreadToken\" (Indicator: \"NtOpenThreadToken\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
"origin": "File/Memory",
"attck_id": "T1033",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1033"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "Spyware/Information Retrieval",
"identifier": "string-534",
"type": 2,
"relevance": 0,
"name": "Contains ability to read files (API string)",
"description": "Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
"origin": "File/Memory",
"attck_id": "T1083",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1083"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "Spyware/Information Retrieval",
"identifier": "string-83",
"type": 2,
"relevance": 1,
"name": "Contains ability to enumerate files on disk (API string)",
"description": "Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
"origin": "File/Memory",
"attck_id": "T1083",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1083"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "Spyware/Information Retrieval",
"identifier": "string-317",
"type": 2,
"relevance": 1,
"name": "Contains ability to retrieve address of exported function from a DLL (API string)",
"description": "Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
"origin": "File/Memory",
"attck_id": "T1106",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1106"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "Spyware/Information Retrieval",
"identifier": "string-207",
"type": 2,
"relevance": 1,
"name": "Contains ability to retrieve file and directory information (API string)",
"description": "Found reference to API \"GetFileSize\" (Indicator: \"GetFileSize\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetFileAttributesExW\" (Indicator: \"GetFileAttributes\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetCurrentDirectoryW\" (Indicator: \"GetCurrentDirectory\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetFileInformationByHandleEx\" (Indicator: \"GetFileInformationByHandle\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetFileSize\" (Indicator: \"GetFileSize\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"GetFileAttributesExW\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"GetCurrentDirectoryW\" (Indicator: \"GetCurrentDirectory\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"GetFileInformationByHandleEx\" (Indicator: \"GetFileInformationByHandle\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
"origin": "File/Memory",
"attck_id": "T1083",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1083"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "Spyware/Information Retrieval",
"identifier": "string-427",
"type": 2,
"relevance": 1,
"name": "Contains ability to retrieve a module handle (API string)",
"description": "Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
"origin": "File/Memory",
"attck_id": "T1082",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1082"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "Spyware/Information Retrieval",
"identifier": "string-107",
"type": 2,
"relevance": 1,
"name": "Contains ability to retrieve the host's architecture (API string)",
"description": "Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
"origin": "File/Memory",
"attck_id": "T1082",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1082"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "Spyware/Information Retrieval",
"identifier": "string-229",
"type": 2,
"relevance": 1,
"name": "Contains ability to query registry keys (API string)",
"description": "Found reference to API \"RegQueryValueExW\" (Indicator: \"RegQueryValue\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"RegOpenKeyExW\" (Indicator: \"RegOpenKey\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"RegEnumKeyExW\" (Indicator: \"RegEnumKey\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"RegQueryValueExW\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"RegOpenKeyExW\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"RegEnumKeyExW\" (Indicator: \"RegEnumKey\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
"origin": "File/Memory",
"attck_id": "T1012",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1012"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "Spyware/Information Retrieval",
"identifier": "string-164",
"type": 2,
"relevance": 1,
"name": "Contains ability to retrieve the fully qualified path of module (API string)",
"description": "Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
"origin": "File/Memory",
"attck_id": "T1106",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1106"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "Spyware/Information Retrieval",
"identifier": "string-80",
"type": 2,
"relevance": 1,
"name": "Contains ability to determine disk drive type (API string)",
"description": "Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
"origin": "File/Memory",
"attck_id": "T1082",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1082"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "Spyware/Information Retrieval",
"identifier": "string-205",
"type": 2,
"relevance": 1,
"name": "Contains ability to retrieve the time elapsed since the system was started (API string)",
"description": "Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
"origin": "File/Memory",
"attck_id": "T1497.003",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1497/003"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "Network Related",
"identifier": "string-3",
"type": 2,
"relevance": 3,
"name": "Found potential URL in binary/memory",
"description": "Heuristic match: \"fD9.tH\"\n Pattern match: \"http://schemas.microsoft.com/SMI/2005/WindowsSettings\"\n Heuristic match: \"(s.IL\"",
"origin": "File/Memory",
"attck_id": "T1071",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1071"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "Network Related",
"identifier": "string-257",
"type": 2,
"relevance": 1,
"name": "Contains ability to enumerate network resources (API string)",
"description": "Found reference to API \"WNetGetConnectionWStub\" (Indicator: \"NetGetConnection\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"WNetAddConnection2WStub\" (Indicator: \"NetAddConnection\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"WNetGetConnectionWStub\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"WNetAddConnection2WStub\" (Indicator: \"NetAddConnection\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
"origin": "File/Memory",
"attck_id": "T1049",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1049"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "Network Related",
"identifier": "string-113",
"type": 2,
"relevance": 1,
"name": "Contains ability to provide information and utilities for managing network resources (API string)",
"description": "Found reference to API \"WNetCancelConnection2WStub\" (Indicator: \"WNetCancelConnection\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")",
"origin": "File/Memory",
"attck_id": "T1135",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1135"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "System Security",
"identifier": "registry-173",
"type": 3,
"relevance": 1,
"name": "Queries services related registry keys",
"description": "\"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CONHOST.EXE\"; Value: \"\")",
"origin": "Registry Access",
"attck_id": "T1007",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1007"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "System Security",
"identifier": "string-426",
"type": 2,
"relevance": 1,
"name": "Contains ability to modify file attributes (API string)",
"description": "Found reference to API \"NtSetInformationFile\" (Indicator: \"SetInformationFile\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"NtSetInformationFile\" (Indicator: \"NtSetInformationFile\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"NtSetInformationFile\" (Indicator: \"SetInformationFile\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"NtSetInformationFile\" (Indicator: \"NtSetInformationFile\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
"origin": "File/Memory",
"attck_id": "T1222",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1222"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "System Security",
"identifier": "string-114",
"type": 2,
"relevance": 1,
"name": "Contains ability to obtains specified information about the security of a file or directory (API string)",
"description": "Found reference to API \"RevertToSelf\" (Indicator: \"RevertToSelf\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetFileSecurityW\" (Indicator: \"GetFileSecurityW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetSecurityDescriptorOwner\" (Indicator: \"GetSecurityDescriptorOwner\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"RevertToSelf\" (Indicator: \"RevertToSelf\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"GetFileSecurityW\" (Indicator: \"GetFileSecurityW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"GetSecurityDescriptorOwner\" (Indicator: \"GetSecurityDescriptorOwner\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
"origin": "File/Memory",
"attck_id": "T1134.001",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1134/001"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "System Security",
"identifier": "string-230",
"type": 2,
"relevance": 1,
"name": "Contains ability to delete registry key/value (API string)",
"description": "Found reference to API \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"RegDeleteKeyExW\" (Indicator: \"RegDeleteKey\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"RegDeleteKeyExW\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
"origin": "File/Memory",
"attck_id": "T1112",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1112"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "System Security",
"identifier": "string-402",
"type": 2,
"relevance": 1,
"name": "Contains ability to modify process attributes (API string)",
"description": "Found reference to API \"InitializeProcThreadAttributeList\" (Indicator: \"InitializeProcThreadAttributeList\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"UpdateProcThreadAttribute\" (Indicator: \"UpdateProcThreadAttribute\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"InitializeProcThreadAttributeList\" (Indicator: \"InitializeProcThreadAttributeList\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"UpdateProcThreadAttribute\" (Indicator: \"UpdateProcThreadAttribute\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
"origin": "File/Memory",
"attck_id": "T1562.001",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1562/001"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "System Security",
"identifier": "string-168",
"type": 2,
"relevance": 1,
"name": "Contains ability to create process with token (API string)",
"description": "Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcessAsUser\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")",
"origin": "File/Memory",
"attck_id": "T1134.002",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1134/002"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "System Security",
"identifier": "string-535",
"type": 2,
"relevance": 0,
"name": "Contains ability to write files (API string)",
"description": "Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
"origin": "File/Memory",
"attck_id": "T1105",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1105"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "System Security",
"identifier": "string-308",
"type": 2,
"relevance": 1,
"name": "Contains ability to delete files/directories (API string)",
"description": "Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
"origin": "File/Memory",
"attck_id": "T1070.004",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1070/004"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "System Security",
"identifier": "string-316",
"type": 2,
"relevance": 1,
"name": "Contains ability to terminate a process (API string)",
"description": "Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
"origin": "File/Memory",
"attck_id": "T1489",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1489"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "System Security",
"identifier": "static-87",
"type": 0,
"relevance": 1,
"name": "Imports system security related APIs",
"description": "Observed import api \"GetFileSecurityW\" which can \"Obtains specified information about the security of a file or directory\" [Source: 935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin]\n Observed import api \"GetSecurityDescriptorOwner\" which can \"Retrieves the owner information from a security descriptor\" [Source: 935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin]\n Observed import api \"RevertToSelf\" which can \"Terminates the impersonation of a client application\" [Source: 935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin]",
"origin": "Static Parser",
"attck_id": "T1134.001",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1134/001"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "System Security",
"identifier": "string-474",
"type": 2,
"relevance": 1,
"name": "Contains ability to access device drivers",
"description": "Found string \"\\Device\\HarddiskVolume2\\cmd.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00004716.00000000.77972.69D30000.00000004.mdmp, 00000000-00004716.00000001.79890.69D30000.00000004.mdmp, 00000000-00004716.00000002.81813.69D30000.00000004.mdmp\")",
"origin": "File/Memory",
"attck_id": "T1543.003",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1543/003"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "External Systems",
"identifier": "avtest-1",
"type": 12,
"relevance": 10,
"name": "Sample was identified as clean by Antivirus engines",
"description": "0/71 Antivirus vendors marked sample as malicious (0% detection rate)",
"origin": "External System",
"attck_id": null,
"capec_id": null,
"attck_id_wiki": null
},
{
"threat_level": 1,
"threat_level_human": "suspicious",
"category": "General",
"identifier": "static-92",
"type": 0,
"relevance": 5,
"name": "PE file has unusual entropy resources",
"description": "\"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\" has resource with unusual entropy \"RT_ICON:7.85051980666\"",
"origin": "Static Parser",
"attck_id": "T1027.002",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1027/002"
},
{
"threat_level": 1,
"threat_level_human": "suspicious",
"category": "Unusual Characteristics",
"identifier": "hooks-8",
"type": 11,
"relevance": 10,
"name": "Installs hooks/patches the running process",
"description": "\"cmd.exe\" wrote bytes \"e0e8c4d7f97f0000\" to virtual address \"0x4932E000\" (part of module \"CMD.EXE\")\n \"cmd.exe\" wrote bytes \"a09d036a5b010000608e036a5b01000090b7016a5b010000a090036a5b010000508d016a5b010000502e016a5b01000020c4036a5b01000070bb036a5b01000080bc036a5b0100004078046a5b010000a0ba036a5b0100000088036a5b010000\" to virtual address \"0xE7D74030\" (part of module \"GDI32.DLL\")",
"origin": "Hook Detection",
"attck_id": "T1056.004",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1056/004"
},
{
"threat_level": 1,
"threat_level_human": "suspicious",
"category": "Unusual Characteristics",
"identifier": "static-1",
"type": 0,
"relevance": 1,
"name": "Imports suspicious APIs",
"description": "UnhandledExceptionFilter\n GetDriveTypeW\n GetFileAttributesW\n GetFileSize\n CreateDirectoryW\n DeleteFileW\n WriteFile\n FindNextFileW\n FindFirstFileW\n FindFirstFileExW\n GetFileAttributesExW\n CreateFileW\n DeviceIoControl\n CopyFileW\n GetProcAddress\n LoadLibraryExW\n GetModuleFileNameW\n GetModuleHandleW\n VirtualAlloc\n ReadProcessMemory\n GetCommandLineW\n TerminateProcess\n CreateProcessW\n GetStartupInfoW\n CreateProcessAsUserW\n RegCreateKeyExW\n RegDeleteValueW\n RegCloseKey\n RegEnumKeyExW\n RegOpenKeyExW\n RegDeleteKeyExW\n Sleep\n GetTickCount\n NtQueryInformationToken\n NtQueryInformationProcess",
"origin": "Static Parser",
"attck_id": "T1106",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1106"
},
{
"threat_level": 1,
"threat_level_human": "suspicious",
"category": "Anti-Reverse Engineering",
"identifier": "static-6",
"type": 0,
"relevance": 3,
"name": "PE file has unusual entropy sections",
"description": ".didat with unusual entropies 0.907093089296",
"origin": "Static Parser",
"attck_id": "T1027.002",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1027/002"
},
{
"threat_level": 2,
"threat_level_human": "malicious",
"category": "Anti-Detection/Stealthyness",
"identifier": "target-94",
"type": 9,
"relevance": 3,
"name": "Found a system process name at an unusual pathway",
"description": "Process \"cmd.exe\" has a system process name but is not located in a Windows (sub-)directory (UID: 00000000-00004716)",
"origin": "Monitored Target",
"attck_id": "T1036.005",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/techniques/T1036/005"
}
]
},
{
"classification_tags": [],
"tags": [],
"submissions": [
{
"submission_id": "60f5dadb3ddbd71a493b4e50",
"filename": "file",
"url": null,
"created_at": "2021-07-19T20:04:43+00:00"
},
{
"submission_id": "60e87e8ed717cf14e5771f4f",
"filename": "file",
"url": null,
"created_at": "2021-07-09T16:51:26+00:00"
},
{
"submission_id": "5f196598c665454d4960c94d",
"filename": "file",
"url": null,
"created_at": "2020-07-23T10:25:28+00:00"
}
],
"machine_learning_models": [],
"crowdstrike_ai": {
"executable_process_memory_analysis": [],
"analysis_related_urls": []
},
"job_id": null,
"environment_id": null,
"environment_description": "Static Analysis",
"size": 232960,
"type": "PE32+ executable (console) x86-64, for MS Windows",
"type_short": [
"peexe",
"64bits",
"executable"
],
"target_url": null,
"state": "SUCCESS",
"error_type": null,
"error_origin": null,
"submit_name": "file",
"md5": "f4f684066175b77e0c3a000549d2922c",
"sha1": "99ae9c73e9bee6f9c76d6f4093a9882df06832cf",
"sha256": "935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2",
"sha512": "fe8f0593cc335ad28eb90211bc4ff01a3d2992cffb3877d04cefede9ef94afeb1a7d7874dd0c0ae04eaf8308291d5a4d879e6ecf6fe2b8d0ff1c3ac7ef143206",
"ssdeep": null,
"imphash": null,
"entrypoint": null,
"entrypoint_section": null,
"image_base": null,
"subsystem": null,
"image_file_characteristics": [],
"dll_characteristics": [],
"major_os_version": null,
"minor_os_version": null,
"av_detect": 0,
"vx_family": null,
"url_analysis": false,
"analysis_start_time": "2020-07-23T10:25:28+00:00",
"threat_score": null,
"interesting": false,
"threat_level": 0,
"verdict": "no specific threat",
"certificates": [],
"is_certificates_valid": null,
"certificates_validation_message": null,
"domains": [],
"compromised_hosts": [],
"hosts": [],
"total_network_connections": 0,
"total_processes": 0,
"total_signatures": 0,
"extracted_files": [],
"file_metadata": null,
"processes": [],
"mitre_attcks": [],
"network_mode": "default",
"signatures": []
},
{
"classification_tags": [],
"tags": [],
"submissions": [
{
"submission_id": "60195513efa3090ef70210f9",
"filename": "utilman.exe",
"url": null,
"created_at": "2021-02-02T13:35:15+00:00"
},
{
"submission_id": "5fd594e5fbef250536222759",
"filename": "cmd.exe",
"url": null,
"created_at": "2020-12-13T04:13:25+00:00"
},
{
"submission_id": "5f75727102a5f179cd29069e",
"filename": "cmd.exe",
"url": null,
"created_at": "2020-10-01T06:08:49+00:00"
},
{
"submission_id": "5ec0ceb2d7ce6a2712303213",
"filename": "Utilman.exe",
"url": null,
"created_at": "2020-05-17T05:42:10+00:00"
},
{
"submission_id": "5e53273fb30de355842896a2",
"filename": "cmd.exe",
"url": null,
"created_at": "2020-02-24T01:30:39+00:00"
},
{
"submission_id": "5d288eb0038838a74cfa9906",
"filename": "cmd.exe",
"url": null,
"created_at": "2019-07-12T13:44:16+00:00"
},
{
"submission_id": "5d2500bd0288388e538437b1",
"filename": "cmd.exe",
"url": null,
"created_at": "2019-07-09T21:01:49+00:00"
},
{
"submission_id": "5cbea1b4038838399c0365ff",
"filename": "cmd.exe",
"url": null,
"created_at": "2019-04-23T05:25:08+00:00"
},
{
"submission_id": "5c35e7b37ca3e11e9f79e9a4",
"filename": "sethc.exe",
"url": null,
"created_at": "2019-01-09T06:23:15-06:00"
},
{
"submission_id": "5c35cef37ca3e1571e6b9436",
"filename": "sethc.exe",
"url": null,
"created_at": "2019-01-09T04:37:39-06:00"
},
{
"submission_id": "5c35cdce7ca3e1550a1e6a92",
"filename": "sethc.exe",
"url": null,
"created_at": "2019-01-09T04:32:46-06:00"
},
{
"submission_id": "5b577fba7ca3e13656490373",
"filename": "cmd.exe",
"url": null,
"created_at": "2018-07-24T14:36:26-05:00"
},
{
"submission_id": "5b5601b37ca3e171691d73e2",
"filename": "cmd.exe",
"url": null,
"created_at": "2018-07-23T11:26:27-05:00"
},
{
"submission_id": "5b0e04857ca3e14c8f62c6fb",
"filename": "cmd.exe",
"url": null,
"created_at": "2018-05-29T20:55:17-05:00"
},
{
"submission_id": "5ad854a47ca3e1453f07bc82",
"filename": "cmd.exe",
"url": null,
"created_at": "2018-04-19T03:34:44-05:00"
},
{
"submission_id": "5ab269537ca3e101fb04a953",
"filename": "cmd.exe",
"url": null,
"created_at": "2018-03-21T09:16:51-05:00"
},
{
"submission_id": "5ab0cffe7ca3e12af23357d3",
"filename": "cmd.exe",
"url": null,
"created_at": "2018-03-20T04:10:22-05:00"
},
{
"submission_id": "5a94e29e7ca3e122510713e2",
"filename": "cmd.exe",
"url": null,
"created_at": "2018-02-26T22:46:22-06:00"
},
{
"submission_id": "5a26f15e7ca3e1169435c782",
"filename": "cmd.exe",
"url": null,
"created_at": "2017-12-05T13:19:58-06:00"
},
{
"submission_id": "5a26f0c47ca3e1158b6ee0e2",
"filename": "cmd.exe",
"url": null,
"created_at": "2017-12-05T13:17:24-06:00"
}
],
"machine_learning_models": [],
"crowdstrike_ai": {
"executable_process_memory_analysis": [],
"analysis_related_urls": []
},
"job_id": "58593319aac2edc56d351531",
"environment_id": 100,
"environment_description": "Windows 7 32 bit",
"size": 232960,
"type": "PE32+ executable (console) x86-64, for MS Windows",
"type_short": [
"peexe",
"64bits",
"executable"
],
"target_url": null,
"state": "SUCCESS",
"error_type": null,
"error_origin": null,
"submit_name": "cmd.exe",
"md5": "f4f684066175b77e0c3a000549d2922c",
"sha1": "99ae9c73e9bee6f9c76d6f4093a9882df06832cf",
"sha256": "935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2",
"sha512": "fe8f0593cc335ad28eb90211bc4ff01a3d2992cffb3877d04cefede9ef94afeb1a7d7874dd0c0ae04eaf8308291d5a4d879e6ecf6fe2b8d0ff1c3ac7ef143206",
"ssdeep": "3072:bkd4COZG6/A1tO1Y6TbkX2FtynroeJ/MEJoSsasbLLkhyjyGe:bkuC9+Af0Y6TbbFtkoeJk1KsfLXm",
"imphash": "3062ed732d4b25d1c64f084dac97d37a",
"entrypoint": "0x140015190",
"entrypoint_section": ".text",
"image_base": null,
"subsystem": null,
"image_file_characteristics": [],
"dll_characteristics": [],
"major_os_version": null,
"minor_os_version": null,
"av_detect": 0,
"vx_family": null,
"url_analysis": false,
"analysis_start_time": "2020-02-24T01:30:48+00:00",
"threat_score": 30,
"interesting": false,
"threat_level": 3,
"verdict": "no verdict",
"certificates": [],
"is_certificates_valid": null,
"certificates_validation_message": null,
"domains": [],
"compromised_hosts": [],
"hosts": [],
"total_network_connections": 0,
"total_processes": 1,
"total_signatures": 14,
"extracted_files": [],
"file_metadata": null,
"processes": [],
"mitre_attcks": [
{
"tactic": "Discovery",
"technique": "System Time Discovery",
"attck_id": "T1124",
"attck_id_wiki": "https://attack.mitre.org/wiki/Technique/T1124",
"malicious_identifiers_count": 0,
"malicious_identifiers": [],
"suspicious_identifiers_count": 0,
"suspicious_identifiers": [],
"informative_identifiers_count": 1,
"informative_identifiers": [],
"parent": null
},
{
"tactic": "Discovery",
"technique": "File and Directory Discovery",
"attck_id": "T1083",
"attck_id_wiki": "https://attack.mitre.org/wiki/Technique/T1083",
"malicious_identifiers_count": 0,
"malicious_identifiers": [],
"suspicious_identifiers_count": 0,
"suspicious_identifiers": [],
"informative_identifiers_count": 1,
"informative_identifiers": [],
"parent": null
}
],
"network_mode": "default",
"signatures": [
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "General",
"identifier": "string-7",
"type": 2,
"relevance": 1,
"name": "Contains PDB pathways",
"description": "\"cmd.pdb\"",
"origin": "File/Memory",
"attck_id": null,
"capec_id": null,
"attck_id_wiki": null
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "Anti-Reverse Engineering",
"identifier": "stream-4",
"type": 1,
"relevance": 1,
"name": "Contains ability to register a top-level exception handler (often used as anti-debugging trick)",
"description": "SetUnhandledExceptionFilter@api-ms-win-core-errorhandling-l1-1-1.dll at 43727-268-00000001400151E4",
"origin": "Hybrid Analysis Technology",
"attck_id": null,
"capec_id": null,
"attck_id_wiki": null
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "Environment Awareness",
"identifier": "stream-49",
"type": 1,
"relevance": 1,
"name": "Contains ability to query the system locale",
"description": "GetUserDefaultLCID@api-ms-win-core-localization-l1-2-1.dll at 43727-287-00000001400069BC",
"origin": "Hybrid Analysis Technology",
"attck_id": null,
"capec_id": null,
"attck_id_wiki": null
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "Environment Awareness",
"identifier": "stream-2",
"type": 1,
"relevance": 1,
"name": "Contains ability to query machine time",
"description": "GetSystemTime@api-ms-win-core-sysinfo-l1-2-1.dll at 43727-284-0000000140002BA0\n GetSystemTime@api-ms-win-core-sysinfo-l1-2-1.dll at 43727-285-000000014001F53C\n GetSystemTime@api-ms-win-core-sysinfo-l1-2-1.dll at 43727-296-00000001400020C8\n GetLocalTime@api-ms-win-core-sysinfo-l1-2-1.dll at 43727-993-000000014001F6C3\n GetSystemTimeAsFileTime@api-ms-win-core-sysinfo-l1-2-1.dll at 43727-599-00000001400156B4",
"origin": "Hybrid Analysis Technology",
"attck_id": "T1124",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/wiki/Technique/T1124"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "Environment Awareness",
"identifier": "stream-3",
"type": 1,
"relevance": 1,
"name": "Contains ability to query the machine version",
"description": "GetVersion@api-ms-win-core-sysinfo-l1-2-1.dll at 43727-439-0000000140001008",
"origin": "Hybrid Analysis Technology",
"attck_id": null,
"capec_id": null,
"attck_id_wiki": null
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "Environment Awareness",
"identifier": "stream-37",
"type": 1,
"relevance": 3,
"name": "Contains ability to query volume size",
"description": "GetDiskFreeSpaceExW@api-ms-win-core-file-l1-2-1.dll at 43727-485-000000014002542C",
"origin": "Hybrid Analysis Technology",
"attck_id": "T1083",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/wiki/Technique/T1083"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "Environment Awareness",
"identifier": "stream-31",
"type": 1,
"relevance": 1,
"name": "Possibly tries to detect the presence of a debugger",
"description": "GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 43727-314-000000014000BC30\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 43727-316-0000000140008FA0\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 43727-270-000000014000B4A0\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 43727-271-000000014000B530\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 43727-277-0000000140011840\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 43727-297-000000014000E278\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 43727-298-000000014000E2EC\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 43727-305-0000000140005C6C\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 43727-661-00000001400016F0\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 43727-331-0000000140014D2C\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 43727-355-0000000140005954\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 43727-366-00000001400032FC\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 43727-383-000000014000D360\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 43727-441-000000014000D110\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 43727-511-000000014000B170\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 43727-523-000000014000BCE0\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 43727-588-0000000140006418\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 43727-596-000000014001168C\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 43727-605-0000000140014190\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 43727-607-0000000140014044",
"origin": "Hybrid Analysis Technology",
"attck_id": null,
"capec_id": null,
"attck_id_wiki": null
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "Network Related",
"identifier": "string-3",
"type": 2,
"relevance": 10,
"name": "Found potential URL in binary/memory",
"description": "Pattern match: \"http://schemas.microsoft.com/SMI/2005/WindowsSettings\"",
"origin": "File/Memory",
"attck_id": null,
"capec_id": null,
"attck_id_wiki": null
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "External Systems",
"identifier": "avtest-1",
"type": 12,
"relevance": 10,
"name": "Sample was identified as clean by Antivirus engines",
"description": "0/68 Antivirus vendors marked sample as malicious (0% detection rate)\n 0/22 Antivirus vendors marked sample as malicious (0% detection rate)",
"origin": "External System",
"attck_id": null,
"capec_id": null,
"attck_id_wiki": null
},
{
"threat_level": 1,
"threat_level_human": "suspicious",
"category": "Unusual Characteristics",
"identifier": "static-60",
"type": 0,
"relevance": 10,
"name": "PE file contains unusual section name",
"description": "\"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\" has a section named \".didat\"",
"origin": "Static Parser",
"attck_id": null,
"capec_id": null,
"attck_id_wiki": null
},
{
"threat_level": 1,
"threat_level_human": "suspicious",
"category": "Unusual Characteristics",
"identifier": "static-1",
"type": 0,
"relevance": 1,
"name": "Imports suspicious APIs",
"description": "UnhandledExceptionFilter\n GetDriveTypeW\n GetFileAttributesW\n GetFileSize\n CreateDirectoryW\n DeleteFileW\n WriteFile\n FindNextFileW\n FindFirstFileW\n FindFirstFileExW\n GetFileAttributesExW\n CreateFileW\n DeviceIoControl\n CopyFileW\n GetProcAddress\n LoadLibraryExW\n GetModuleFileNameW\n GetModuleHandleW\n VirtualAlloc\n ReadProcessMemory\n GetCommandLineW\n TerminateProcess\n CreateProcessW\n GetStartupInfoW\n CreateProcessAsUserW\n RegCreateKeyExW\n RegDeleteValueW\n RegCloseKey\n RegEnumKeyExW\n RegOpenKeyExW\n RegDeleteKeyExW\n Sleep\n GetTickCount\n NtQueryInformationToken\n NtQueryInformationProcess",
"origin": "Static Parser",
"attck_id": null,
"capec_id": null,
"attck_id_wiki": null
},
{
"threat_level": 1,
"threat_level_human": "suspicious",
"category": "Anti-Detection/Stealthyness",
"identifier": "stream-42",
"type": 1,
"relevance": 3,
"name": "Possibly tries to hide a process launching it with different user credentials",
"description": "CreateProcessAsUserW@api-ms-win-core-processthreads-l1-1-2.dll at 43727-828-000000014000EFFE",
"origin": "Hybrid Analysis Technology",
"attck_id": null,
"capec_id": null,
"attck_id_wiki": null
},
{
"threat_level": 2,
"threat_level_human": "malicious",
"category": "General",
"identifier": "stream-21",
"type": 1,
"relevance": 8,
"name": "Contains ability to start/interact with device drivers",
"description": "DeviceIoControl@api-ms-win-core-io-l1-1-1.dll at 43727-611-0000000140013690",
"origin": "Hybrid Analysis Technology",
"attck_id": null,
"capec_id": null,
"attck_id_wiki": null
},
{
"threat_level": 2,
"threat_level_human": "malicious",
"category": "Unusual Characteristics",
"identifier": "stream-22",
"type": 1,
"relevance": 5,
"name": "Contains native function calls",
"description": "NtFsControlFile@ntdll.dll at 43727-309-00000001400268C4\n NtCancelSynchronousIoFile@ntdll.dll at 43727-532-00000001400227A0\n NtOpenThreadToken@ntdll.dll at 43727-585-00000001400029C0\n NtQueryInformationToken@ntdll.dll at 43727-586-0000000140002A84\n NtQueryInformationToken@ntdll.dll at 43727-587-0000000140002AD4\n NtQueryInformationProcess@ntdll.dll at 43727-630-0000000140004480\n NtOpenFile@ntdll.dll at 43727-643-00000001400042DC\n NtQueryVolumeInformationFile@ntdll.dll at 43727-644-00000001400043D8",
"origin": "Hybrid Analysis Technology",
"attck_id": null,
"capec_id": null,
"attck_id_wiki": null
}
]
},
{
"classification_tags": [],
"tags": [],
"submissions": [
{
"submission_id": "5f85aeb7dbdeb607bb5e34eb",
"filename": "kiss.exe",
"url": null,
"created_at": "2020-10-13T13:42:15+00:00"
},
{
"submission_id": "5d8b4dbf028838d6417f6d53",
"filename": "cmd.exe",
"url": null,
"created_at": "2019-09-25T11:21:35+00:00"
},
{
"submission_id": "5d8b4db702883891837f6b95",
"filename": "cmd.exe",
"url": null,
"created_at": "2019-09-25T11:21:27+00:00"
},
{
"submission_id": "5d4846eb0288385a279299b7",
"filename": "cmd.exe",
"url": null,
"created_at": "2019-08-05T15:10:35+00:00"
},
{
"submission_id": "5d250066038838da118437b2",
"filename": "cmd.exe",
"url": null,
"created_at": "2019-07-09T21:00:22+00:00"
},
{
"submission_id": "5ce828c5038838ca61130390",
"filename": "cmd.exe",
"url": null,
"created_at": "2019-05-24T17:24:21+00:00"
},
{
"submission_id": "5cb263840388384184827cf6",
"filename": "sethc.exe",
"url": null,
"created_at": "2019-04-13T22:32:36+00:00"
},
{
"submission_id": "5b69b6167ca3e129e233b695",
"filename": "cmd.exe",
"url": null,
"created_at": "2018-08-07T10:09:10-05:00"
},
{
"submission_id": "5b576e3e7ca3e1632e094913",
"filename": "cmd.exe",
"url": null,
"created_at": "2018-07-24T13:21:50-05:00"
},
{
"submission_id": "5b576ce57ca3e15a46380635",
"filename": "cmd.exe",
"url": null,
"created_at": "2018-07-24T13:16:05-05:00"
},
{
"submission_id": "5ab0d1057ca3e12dbd5d09f2",
"filename": "cmd.exe",
"url": null,
"created_at": "2018-03-20T04:14:45-05:00"
},
{
"submission_id": "5a7c75817ca3e13c9b2ebf52",
"filename": "cmd.exe",
"url": null,
"created_at": "2018-02-08T10:06:25-06:00"
},
{
"submission_id": "5a34f2a27ca3e13531789a94",
"filename": "cmd.exe",
"url": null,
"created_at": "2017-12-16T04:17:06-06:00"
}
],
"machine_learning_models": [],
"crowdstrike_ai": {
"executable_process_memory_analysis": [],
"analysis_related_urls": []
},
"job_id": "5a34f2a27ca3e13531789a95",
"environment_id": 120,
"environment_description": "Windows 7 64 bit",
"size": 232960,
"type": "PE32+ executable (console) x86-64, for MS Windows",
"type_short": [
"peexe",
"64bits",
"executable"
],
"target_url": null,
"state": "SUCCESS",
"error_type": null,
"error_origin": null,
"submit_name": "cmd.exe",
"md5": "f4f684066175b77e0c3a000549d2922c",
"sha1": "99ae9c73e9bee6f9c76d6f4093a9882df06832cf",
"sha256": "935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2",
"sha512": "fe8f0593cc335ad28eb90211bc4ff01a3d2992cffb3877d04cefede9ef94afeb1a7d7874dd0c0ae04eaf8308291d5a4d879e6ecf6fe2b8d0ff1c3ac7ef143206",
"ssdeep": "3072:bkd4COZG6/A1tO1Y6TbkX2FtynroeJ/MEJoSsasbLLkhyjyGe:bkuC9+Af0Y6TbbFtkoeJk1KsfLXm",
"imphash": "3062ed732d4b25d1c64f084dac97d37a",
"entrypoint": "0x140015190",
"entrypoint_section": ".text",
"image_base": null,
"subsystem": null,
"image_file_characteristics": [],
"dll_characteristics": [],
"major_os_version": null,
"minor_os_version": null,
"av_detect": 0,
"vx_family": null,
"url_analysis": false,
"analysis_start_time": "2019-09-25T11:21:32+00:00",
"threat_score": 30,
"interesting": false,
"threat_level": 3,
"verdict": "no verdict",
"certificates": [],
"is_certificates_valid": null,
"certificates_validation_message": null,
"domains": [],
"compromised_hosts": [],
"hosts": [],
"total_network_connections": 0,
"total_processes": 1,
"total_signatures": 14,
"extracted_files": [],
"file_metadata": null,
"processes": [],
"mitre_attcks": [
{
"tactic": "Discovery",
"technique": "File and Directory Discovery",
"attck_id": "T1083",
"attck_id_wiki": "https://attack.mitre.org/wiki/Technique/T1083",
"malicious_identifiers_count": 0,
"malicious_identifiers": [],
"suspicious_identifiers_count": 0,
"suspicious_identifiers": [],
"informative_identifiers_count": 1,
"informative_identifiers": [],
"parent": null
},
{
"tactic": "Discovery",
"technique": "System Time Discovery",
"attck_id": "T1124",
"attck_id_wiki": "https://attack.mitre.org/wiki/Technique/T1124",
"malicious_identifiers_count": 0,
"malicious_identifiers": [],
"suspicious_identifiers_count": 0,
"suspicious_identifiers": [],
"informative_identifiers_count": 1,
"informative_identifiers": [],
"parent": null
}
],
"network_mode": "default",
"signatures": [
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "General",
"identifier": "string-7",
"type": 2,
"relevance": 1,
"name": "Contains PDB pathways",
"description": "\"cmd.pdb\"",
"origin": "File/Memory",
"attck_id": null,
"capec_id": null,
"attck_id_wiki": null
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "Anti-Reverse Engineering",
"identifier": "stream-4",
"type": 1,
"relevance": 1,
"name": "Contains ability to register a top-level exception handler (often used as anti-debugging trick)",
"description": "SetUnhandledExceptionFilter@api-ms-win-core-errorhandling-l1-1-1.dll at 12264-268-00000001400151E4",
"origin": "Hybrid Analysis Technology",
"attck_id": null,
"capec_id": null,
"attck_id_wiki": null
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "Environment Awareness",
"identifier": "stream-31",
"type": 1,
"relevance": 1,
"name": "Possibly tries to detect the presence of a debugger",
"description": "GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 12264-314-000000014000BC30\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 12264-316-0000000140008FA0\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 12264-270-000000014000B4A0\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 12264-271-000000014000B530\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 12264-277-0000000140011840\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 12264-331-0000000140014D2C\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 12264-297-000000014000E278\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 12264-298-000000014000E2EC\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 12264-305-0000000140005C6C\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 12264-383-000000014000D360\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 12264-355-0000000140005954\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 12264-366-00000001400032FC\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 12264-441-000000014000D110\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 12264-511-000000014000B170\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 12264-523-000000014000BCE0\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 12264-588-0000000140006418\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 12264-596-000000014001168C\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 12264-605-0000000140014190\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 12264-623-00000001400123F0\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 12264-607-0000000140014044",
"origin": "Hybrid Analysis Technology",
"attck_id": null,
"capec_id": null,
"attck_id_wiki": null
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "Environment Awareness",
"identifier": "stream-37",
"type": 1,
"relevance": 3,
"name": "Contains ability to query volume size",
"description": "GetDiskFreeSpaceExW@api-ms-win-core-file-l1-2-1.dll at 12264-485-000000014002542C",
"origin": "Hybrid Analysis Technology",
"attck_id": "T1083",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/wiki/Technique/T1083"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "Environment Awareness",
"identifier": "stream-2",
"type": 1,
"relevance": 1,
"name": "Contains ability to query machine time",
"description": "GetSystemTime@api-ms-win-core-sysinfo-l1-2-1.dll at 12264-284-0000000140002BA0\n GetSystemTime@api-ms-win-core-sysinfo-l1-2-1.dll at 12264-285-000000014001F53C\n GetSystemTime@api-ms-win-core-sysinfo-l1-2-1.dll at 12264-296-00000001400020C8\n GetSystemTimeAsFileTime@api-ms-win-core-sysinfo-l1-2-1.dll at 12264-599-00000001400156B4\n GetLocalTime@api-ms-win-core-sysinfo-l1-2-1.dll at 12264-993-000000014001F6C3",
"origin": "Hybrid Analysis Technology",
"attck_id": "T1124",
"capec_id": null,
"attck_id_wiki": "https://attack.mitre.org/wiki/Technique/T1124"
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "Environment Awareness",
"identifier": "stream-3",
"type": 1,
"relevance": 1,
"name": "Contains ability to query the machine version",
"description": "GetVersion@api-ms-win-core-sysinfo-l1-2-1.dll at 12264-439-0000000140001008",
"origin": "Hybrid Analysis Technology",
"attck_id": null,
"capec_id": null,
"attck_id_wiki": null
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "Environment Awareness",
"identifier": "stream-49",
"type": 1,
"relevance": 1,
"name": "Contains ability to query the system locale",
"description": "GetUserDefaultLCID@api-ms-win-core-localization-l1-2-1.dll at 12264-287-00000001400069BC",
"origin": "Hybrid Analysis Technology",
"attck_id": null,
"capec_id": null,
"attck_id_wiki": null
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "Network Related",
"identifier": "string-3",
"type": 2,
"relevance": 10,
"name": "Found potential URL in binary/memory",
"description": "Pattern match: \"http://schemas.microsoft.com/SMI/2005/WindowsSettings\"",
"origin": "File/Memory",
"attck_id": null,
"capec_id": null,
"attck_id_wiki": null
},
{
"threat_level": 0,
"threat_level_human": "informative",
"category": "External Systems",
"identifier": "avtest-1",
"type": 12,
"relevance": 10,
"name": "Sample was identified as clean by Antivirus engines",
"description": "0/16 Antivirus vendors marked sample as malicious (0% detection rate)\n 0/70 Antivirus vendors marked sample as malicious (0% detection rate)",
"origin": "External System",
"attck_id": null,
"capec_id": null,
"attck_id_wiki": null
},
{
"threat_level": 1,
"threat_level_human": "suspicious",
"category": "Unusual Characteristics",
"identifier": "static-60",
"type": 0,
"relevance": 10,
"name": "PE file contains unusual section name",
"description": "\"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\" has a section named \".didat\"",
"origin": "Static Parser",
"attck_id": null,
"capec_id": null,
"attck_id_wiki": null
},
{
"threat_level": 1,
"threat_level_human": "suspicious",
"category": "Unusual Characteristics",
"identifier": "static-1",
"type": 0,
"relevance": 1,
"name": "Imports suspicious APIs",
"description": "UnhandledExceptionFilter\n GetDriveTypeW\n GetFileAttributesW\n GetFileSize\n CreateDirectoryW\n DeleteFileW\n WriteFile\n FindNextFileW\n FindFirstFileW\n FindFirstFileExW\n GetFileAttributesExW\n CreateFileW\n DeviceIoControl\n CopyFileW\n GetProcAddress\n LoadLibraryExW\n GetModuleFileNameW\n GetModuleHandleW\n VirtualAlloc\n ReadProcessMemory\n GetCommandLineW\n TerminateProcess\n CreateProcessW\n GetStartupInfoW\n CreateProcessAsUserW\n RegCreateKeyExW\n RegDeleteValueW\n RegCloseKey\n RegEnumKeyExW\n RegOpenKeyExW\n RegDeleteKeyExW\n Sleep\n GetTickCount\n NtQueryInformationToken\n NtQueryInformationProcess",
"origin": "Static Parser",
"attck_id": null,
"capec_id": null,
"attck_id_wiki": null
},
{
"threat_level": 1,
"threat_level_human": "suspicious",
"category": "Anti-Detection/Stealthyness",
"identifier": "stream-42",
"type": 1,
"relevance": 3,
"name": "Possibly tries to hide a process launching it with different user credentials",
"description": "CreateProcessAsUserW@api-ms-win-core-processthreads-l1-1-2.dll at 12264-828-000000014000EFFE",
"origin": "Hybrid Analysis Technology",
"attck_id": null,
"capec_id": null,
"attck_id_wiki": null
},
{
"threat_level": 2,
"threat_level_human": "malicious",
"category": "General",
"identifier": "stream-21",
"type": 1,
"relevance": 8,
"name": "Contains ability to start/interact with device drivers",
"description": "DeviceIoControl@api-ms-win-core-io-l1-1-1.dll at 12264-611-0000000140013690",
"origin": "Hybrid Analysis Technology",
"attck_id": null,
"capec_id": null,
"attck_id_wiki": null
},
{
"threat_level": 2,
"threat_level_human": "malicious",
"category": "Unusual Characteristics",
"identifier": "stream-22",
"type": 1,
"relevance": 5,
"name": "Contains native function calls",
"description": "NtFsControlFile@ntdll.dll at 12264-309-00000001400268C4\n NtCancelSynchronousIoFile@ntdll.dll at 12264-532-00000001400227A0\n NtOpenProcessToken@ntdll.dll at 12264-585-00000001400029C0\n NtQueryInformationToken@ntdll.dll at 12264-586-0000000140002A84\n NtQueryInformationToken@ntdll.dll at 12264-587-0000000140002AD4\n NtSetInformationProcess@ntdll.dll at 12264-630-0000000140004480\n NtOpenFile@ntdll.dll at 12264-643-00000001400042DC\n NtQueryVolumeInformationFile@ntdll.dll at 12264-644-00000001400043D8",
"origin": "Hybrid Analysis Technology",
"attck_id": null,
"capec_id": null,
"attck_id_wiki": null
}
]
}
]
Was this article helpful?