Contents x
    Hybrid Analysis
    • 05 Aug 2023
    • 70 Minutes to read
    • Contributors
    • Print
    • Dark
      Light
    Contents
      This documentation version is deprecated, please click here for the latest version.

    Hybrid Analysis

    • Updated on 05 Aug 2023
    • 70 Minutes to read
    • Contributors
    • Print
    • Dark
      Light
    Article summary

    Hybrid Analysis, aka Falcon Sandbox, is a powerful, free malware analysis service for the community that detects and analyzes unknown threats. Hybrid Analysis has its own unique approach, and offers both public-facing and private team-based sandboxing capabilities.

    LimaCharlie integrates with the following Hybrid Analysis API calls:

    Detection & Response Rules

    Overview

    The Search API accepts a SHA256 value, and provides an extensive overview of a hash (if previously observed by the platform).

    D&R Rule:

    The following D&R rule

    event: NEW_PROCESS
op: lookup
path: event/HASH
resource: lcr://api/hybrid-analysis-overview

    Response Data:

    {
  "result": {
    "analysis_start_time": "2023-07-17T18:31:04+00:00",
    "architecture": "WINDOWS",
    "children_in_progress": 0,
    "children_in_queue": 0,
    "last_file_name": "cmd.exe",
    "last_multi_scan": "2023-07-17T18:31:09+00:00",
    "multiscan_result": 0,
    "other_file_name": [
      "Utilman.exe",
      "file",
      "kiss.exe",
      "osk.exe",
      "sethc.exe",
      "utilman.exe"
    ],
    "related_children_hashes": [],
    "related_parent_hashes": [
      "c502bd80423e10dcc4b59fe4b523acb5ce0bd07748f73c7bdc6c797883b8a417"
    ],
    "related_reports": [
      {
        "environment_id": 100,
        "error_origin": null,
        "error_type": null,
        "job_id": "627e3011d695730f2c3ad419",
        "sha256": "c502bd80423e10dcc4b59fe4b523acb5ce0bd07748f73c7bdc6c797883b8a417",
        "state": "SUCCESS",
        "verdict": "no verdict"
      }
    ],
    "reports": [
      "58593319aac2edc56d351531",
      "5a34f2a27ca3e13531789a95",
      "5f196598eac13102deff3d42",
      "64b588e7e14d64e6a60b2130",
      "5965d8027ca3e10ec737634f",
      "60251a499b1b3016bb674fb4",
      "637f3600a3d94f1ecc7c1800"
    ],
    "scanners": [
      {
        "anti_virus_results": [],
        "error_message": null,
        "name": "CrowdStrike Falcon Static Analysis (ML)",
        "percent": 0,
        "positives": null,
        "progress": 100,
        "status": "clean",
        "total": null
      },
      {
        "anti_virus_results": [],
        "error_message": null,
        "name": "Metadefender",
        "percent": 0,
        "positives": 0,
        "progress": 100,
        "status": "clean",
        "total": 27
      },
      {
        "anti_virus_results": [],
        "error_message": null,
        "name": "VirusTotal",
        "percent": 0,
        "positives": 0,
        "progress": 100,
        "status": "clean",
        "total": 75
      }
    ],
    "scanners_v2": {
      "bfore_ai": null,
      "clean_dns": null,
      "crowdstrike_ml": {
        "anti_virus_results": [],
        "error_message": null,
        "name": "CrowdStrike Falcon Static Analysis (ML)",
        "percent": 0,
        "progress": 100,
        "status": "clean"
      },
      "metadefender": {
        "anti_virus_results": [],
        "error_message": null,
        "name": "Metadefender",
        "percent": 0,
        "positives": 0,
        "progress": 100,
        "status": "clean",
        "total": 27
      },
      "scam_adviser": null,
      "urlscan_io": null,
      "virustotal": {
        "error_message": null,
        "name": "VirusTotal",
        "percent": 0,
        "positives": 0,
        "progress": 100,
        "status": "clean",
        "total": 75
      }
    },
    "sha256": "935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2",
    "size": 232960,
    "submit_context": [],
    "tags": [],
    "threat_score": null,
    "type": "PE32+ executable (console) x86-64, for MS Windows",
    "type_short": [
      "peexe",
      "64bits",
      "executable"
    ],
    "url_analysis": false,
    "verdict": "no specific threat",
    "vx_family": null,
    "whitelisted": false
  }
}

    Search

    The Search lookup provides a basic lookup of a hash value. This look accepts one of the following values:

    • MD5
    • SHA1
    • SHA256

    D&R Rule:

    event: NEW_PROCESS
op: lookup
path: event/HASH
resource: lcr://api/hybrid-analysis-search

    Response Data:

    [
  {
    "classification_tags": [],
    "tags": [],
    "submissions": [
      {
        "submission_id": "64b588e7e14d64e6a60b2131",
        "filename": "cmd.exe",
        "url": null,
        "created_at": "2023-07-17T18:31:03+00:00"
      }
    ],
    "machine_learning_models": [],
    "crowdstrike_ai": {
      "executable_process_memory_analysis": [],
      "analysis_related_urls": []
    },
    "job_id": "64b588e7e14d64e6a60b2130",
    "environment_id": 160,
    "environment_description": "Windows 10 64 bit",
    "size": 232960,
    "type": "PE32+ executable (console) x86-64, for MS Windows",
    "type_short": [
      "peexe",
      "64bits",
      "executable"
    ],
    "target_url": null,
    "state": "SUCCESS",
    "error_type": null,
    "error_origin": null,
    "submit_name": "cmd.exe",
    "md5": "f4f684066175b77e0c3a000549d2922c",
    "sha1": "99ae9c73e9bee6f9c76d6f4093a9882df06832cf",
    "sha256": "935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2",
    "sha512": "fe8f0593cc335ad28eb90211bc4ff01a3d2992cffb3877d04cefede9ef94afeb1a7d7874dd0c0ae04eaf8308291d5a4d879e6ecf6fe2b8d0ff1c3ac7ef143206",
    "ssdeep": "3072:bkd4COZG6/A1tO1Y6TbkX2FtynroeJ/MEJoSsasbLLkhyjyGe:bkuC9+Af0Y6TbbFtkoeJk1KsfLXm",
    "imphash": "3062ed732d4b25d1c64f084dac97d37a",
    "entrypoint": "0x140015190",
    "entrypoint_section": ".text",
    "image_base": "0x140000000",
    "subsystem": "Windows Cui",
    "image_file_characteristics": [
      "EXECUTABLE_IMAGE",
      "LARGE_ADDRESS_AWARE"
    ],
    "dll_characteristics": [
      "GUARD_CF",
      "TERMINAL_SERVER_AWARE",
      "DYNAMIC_BASE",
      "NX_COMPAT",
      "HIGH_ENTROPY_VA"
    ],
    "major_os_version": 10,
    "minor_os_version": 0,
    "av_detect": 0,
    "vx_family": null,
    "url_analysis": false,
    "analysis_start_time": "2023-07-17T18:31:04+00:00",
    "threat_score": null,
    "interesting": false,
    "threat_level": 0,
    "verdict": "no specific threat",
    "certificates": [],
    "is_certificates_valid": false,
    "certificates_validation_message": "No signature was present in the subject. (0x800b0100)",
    "domains": [],
    "compromised_hosts": [],
    "hosts": [],
    "total_network_connections": 0,
    "total_processes": 1,
    "total_signatures": 99,
    "extracted_files": [],
    "file_metadata": null,
    "processes": [],
    "mitre_attcks": [
      {
        "tactic": "Execution",
        "technique": "Shared Modules",
        "attck_id": "T1129",
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1129",
        "malicious_identifiers_count": 0,
        "malicious_identifiers": [],
        "suspicious_identifiers_count": 0,
        "suspicious_identifiers": [],
        "informative_identifiers_count": 3,
        "informative_identifiers": [],
        "parent": null
      },
      {
        "tactic": "Execution",
        "technique": "Native API",
        "attck_id": "T1106",
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1106",
        "malicious_identifiers_count": 0,
        "malicious_identifiers": [],
        "suspicious_identifiers_count": 2,
        "suspicious_identifiers": [],
        "informative_identifiers_count": 10,
        "informative_identifiers": [],
        "parent": null
      },
      {
        "tactic": "Execution",
        "technique": "Windows Command Shell",
        "attck_id": "T1059.003",
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1059/003",
        "malicious_identifiers_count": 0,
        "malicious_identifiers": [],
        "suspicious_identifiers_count": 0,
        "suspicious_identifiers": [],
        "informative_identifiers_count": 1,
        "informative_identifiers": [],
        "parent": {
          "technique": "Command and Scripting Interpreter",
          "attck_id": "T1059",
          "attck_id_wiki": "https://attack.mitre.org/techniques/T1059"
        }
      },
      {
        "tactic": "Persistence",
        "technique": "Windows Service",
        "attck_id": "T1543.003",
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1543/003",
        "malicious_identifiers_count": 0,
        "malicious_identifiers": [],
        "suspicious_identifiers_count": 0,
        "suspicious_identifiers": [],
        "informative_identifiers_count": 2,
        "informative_identifiers": [],
        "parent": {
          "technique": "Create or Modify System Process",
          "attck_id": "T1543",
          "attck_id_wiki": "https://attack.mitre.org/techniques/T1543"
        }
      },
      {
        "tactic": "Persistence",
        "technique": "Create or Modify System Process",
        "attck_id": "T1543",
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1543",
        "malicious_identifiers_count": 0,
        "malicious_identifiers": [],
        "suspicious_identifiers_count": 0,
        "suspicious_identifiers": [],
        "informative_identifiers_count": 1,
        "informative_identifiers": [],
        "parent": null
      },
      {
        "tactic": "Persistence",
        "technique": "Registry Run Keys / Startup Folder",
        "attck_id": "T1547.001",
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1547/001",
        "malicious_identifiers_count": 0,
        "malicious_identifiers": [],
        "suspicious_identifiers_count": 0,
        "suspicious_identifiers": [],
        "informative_identifiers_count": 1,
        "informative_identifiers": [],
        "parent": {
          "technique": "Boot or Logon Autostart Execution",
          "attck_id": "T1547",
          "attck_id_wiki": "https://attack.mitre.org/techniques/T1547"
        }
      },
      {
        "tactic": "Privilege Escalation",
        "technique": "Windows Service",
        "attck_id": "T1543.003",
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1543/003",
        "malicious_identifiers_count": 0,
        "malicious_identifiers": [],
        "suspicious_identifiers_count": 0,
        "suspicious_identifiers": [],
        "informative_identifiers_count": 2,
        "informative_identifiers": [],
        "parent": {
          "technique": "Create or Modify System Process",
          "attck_id": "T1543",
          "attck_id_wiki": "https://attack.mitre.org/techniques/T1543"
        }
      },
      {
        "tactic": "Privilege Escalation",
        "technique": "Token Impersonation/Theft",
        "attck_id": "T1134.001",
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1134/001",
        "malicious_identifiers_count": 0,
        "malicious_identifiers": [],
        "suspicious_identifiers_count": 0,
        "suspicious_identifiers": [],
        "informative_identifiers_count": 3,
        "informative_identifiers": [],
        "parent": {
          "technique": "Access Token Manipulation",
          "attck_id": "T1134",
          "attck_id_wiki": "https://attack.mitre.org/techniques/T1134"
        }
      },
      {
        "tactic": "Privilege Escalation",
        "technique": "Create or Modify System Process",
        "attck_id": "T1543",
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1543",
        "malicious_identifiers_count": 0,
        "malicious_identifiers": [],
        "suspicious_identifiers_count": 0,
        "suspicious_identifiers": [],
        "informative_identifiers_count": 1,
        "informative_identifiers": [],
        "parent": null
      },
      {
        "tactic": "Privilege Escalation",
        "technique": "Create Process with Token",
        "attck_id": "T1134.002",
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1134/002",
        "malicious_identifiers_count": 0,
        "malicious_identifiers": [],
        "suspicious_identifiers_count": 0,
        "suspicious_identifiers": [],
        "informative_identifiers_count": 1,
        "informative_identifiers": [],
        "parent": {
          "technique": "Access Token Manipulation",
          "attck_id": "T1134",
          "attck_id_wiki": "https://attack.mitre.org/techniques/T1134"
        }
      },
      {
        "tactic": "Privilege Escalation",
        "technique": "Dynamic-link Library Injection",
        "attck_id": "T1055.001",
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1055/001",
        "malicious_identifiers_count": 0,
        "malicious_identifiers": [],
        "suspicious_identifiers_count": 0,
        "suspicious_identifiers": [],
        "informative_identifiers_count": 1,
        "informative_identifiers": [],
        "parent": {
          "technique": "Process Injection",
          "attck_id": "T1055",
          "attck_id_wiki": "https://attack.mitre.org/techniques/T1055"
        }
      },
      {
        "tactic": "Privilege Escalation",
        "technique": "Thread Execution Hijacking",
        "attck_id": "T1055.003",
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1055/003",
        "malicious_identifiers_count": 0,
        "malicious_identifiers": [],
        "suspicious_identifiers_count": 1,
        "suspicious_identifiers": [],
        "informative_identifiers_count": 0,
        "informative_identifiers": [],
        "parent": {
          "technique": "Process Injection",
          "attck_id": "T1055",
          "attck_id_wiki": "https://attack.mitre.org/techniques/T1055"
        }
      },
      {
        "tactic": "Privilege Escalation",
        "technique": "Process Injection",
        "attck_id": "T1055",
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1055",
        "malicious_identifiers_count": 0,
        "malicious_identifiers": [],
        "suspicious_identifiers_count": 0,
        "suspicious_identifiers": [],
        "informative_identifiers_count": 2,
        "informative_identifiers": [],
        "parent": null
      },
      {
        "tactic": "Privilege Escalation",
        "technique": "Registry Run Keys / Startup Folder",
        "attck_id": "T1547.001",
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1547/001",
        "malicious_identifiers_count": 0,
        "malicious_identifiers": [],
        "suspicious_identifiers_count": 0,
        "suspicious_identifiers": [],
        "informative_identifiers_count": 1,
        "informative_identifiers": [],
        "parent": {
          "technique": "Boot or Logon Autostart Execution",
          "attck_id": "T1547",
          "attck_id_wiki": "https://attack.mitre.org/techniques/T1547"
        }
      },
      {
        "tactic": "Privilege Escalation",
        "technique": "Extra Window Memory Injection",
        "attck_id": "T1055.011",
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1055/011",
        "malicious_identifiers_count": 0,
        "malicious_identifiers": [],
        "suspicious_identifiers_count": 1,
        "suspicious_identifiers": [],
        "informative_identifiers_count": 0,
        "informative_identifiers": [],
        "parent": {
          "technique": "Process Injection",
          "attck_id": "T1055",
          "attck_id_wiki": "https://attack.mitre.org/techniques/T1055"
        }
      },
      {
        "tactic": "Defense Evasion",
        "technique": "Obfuscated Files or Information",
        "attck_id": "T1027",
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1027",
        "malicious_identifiers_count": 0,
        "malicious_identifiers": [],
        "suspicious_identifiers_count": 0,
        "suspicious_identifiers": [],
        "informative_identifiers_count": 2,
        "informative_identifiers": [],
        "parent": null
      },
      {
        "tactic": "Defense Evasion",
        "technique": "Match Legitimate Name or Location",
        "attck_id": "T1036.005",
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1036/005",
        "malicious_identifiers_count": 1,
        "malicious_identifiers": [],
        "suspicious_identifiers_count": 0,
        "suspicious_identifiers": [],
        "informative_identifiers_count": 0,
        "informative_identifiers": [],
        "parent": {
          "technique": "Masquerading",
          "attck_id": "T1036",
          "attck_id_wiki": "https://attack.mitre.org/techniques/T1036"
        }
      },
      {
        "tactic": "Defense Evasion",
        "technique": "Debugger Evasion",
        "attck_id": "T1622",
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1622",
        "malicious_identifiers_count": 0,
        "malicious_identifiers": [],
        "suspicious_identifiers_count": 0,
        "suspicious_identifiers": [],
        "informative_identifiers_count": 2,
        "informative_identifiers": [],
        "parent": null
      },
      {
        "tactic": "Defense Evasion",
        "technique": "File and Directory Permissions Modification",
        "attck_id": "T1222",
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1222",
        "malicious_identifiers_count": 0,
        "malicious_identifiers": [],
        "suspicious_identifiers_count": 0,
        "suspicious_identifiers": [],
        "informative_identifiers_count": 1,
        "informative_identifiers": [],
        "parent": null
      },
      {
        "tactic": "Defense Evasion",
        "technique": "Token Impersonation/Theft",
        "attck_id": "T1134.001",
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1134/001",
        "malicious_identifiers_count": 0,
        "malicious_identifiers": [],
        "suspicious_identifiers_count": 0,
        "suspicious_identifiers": [],
        "informative_identifiers_count": 3,
        "informative_identifiers": [],
        "parent": {
          "technique": "Access Token Manipulation",
          "attck_id": "T1134",
          "attck_id_wiki": "https://attack.mitre.org/techniques/T1134"
        }
      },
      {
        "tactic": "Defense Evasion",
        "technique": "Timestomp",
        "attck_id": "T1070.006",
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1070/006",
        "malicious_identifiers_count": 0,
        "malicious_identifiers": [],
        "suspicious_identifiers_count": 0,
        "suspicious_identifiers": [],
        "informative_identifiers_count": 2,
        "informative_identifiers": [],
        "parent": {
          "technique": "Indicator Removal",
          "attck_id": "T1070",
          "attck_id_wiki": "https://attack.mitre.org/techniques/T1070"
        }
      },
      {
        "tactic": "Defense Evasion",
        "technique": "Modify Registry",
        "attck_id": "T1112",
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1112",
        "malicious_identifiers_count": 0,
        "malicious_identifiers": [],
        "suspicious_identifiers_count": 0,
        "suspicious_identifiers": [],
        "informative_identifiers_count": 4,
        "informative_identifiers": [],
        "parent": null
      },
      {
        "tactic": "Defense Evasion",
        "technique": "Disable or Modify Tools",
        "attck_id": "T1562.001",
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1562/001",
        "malicious_identifiers_count": 0,
        "malicious_identifiers": [],
        "suspicious_identifiers_count": 0,
        "suspicious_identifiers": [],
        "informative_identifiers_count": 1,
        "informative_identifiers": [],
        "parent": {
          "technique": "Impair Defenses",
          "attck_id": "T1562",
          "attck_id_wiki": "https://attack.mitre.org/techniques/T1562"
        }
      },
      {
        "tactic": "Defense Evasion",
        "technique": "Create Process with Token",
        "attck_id": "T1134.002",
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1134/002",
        "malicious_identifiers_count": 0,
        "malicious_identifiers": [],
        "suspicious_identifiers_count": 0,
        "suspicious_identifiers": [],
        "informative_identifiers_count": 1,
        "informative_identifiers": [],
        "parent": {
          "technique": "Access Token Manipulation",
          "attck_id": "T1134",
          "attck_id_wiki": "https://attack.mitre.org/techniques/T1134"
        }
      },
      {
        "tactic": "Defense Evasion",
        "technique": "Dynamic-link Library Injection",
        "attck_id": "T1055.001",
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1055/001",
        "malicious_identifiers_count": 0,
        "malicious_identifiers": [],
        "suspicious_identifiers_count": 0,
        "suspicious_identifiers": [],
        "informative_identifiers_count": 1,
        "informative_identifiers": [],
        "parent": {
          "technique": "Process Injection",
          "attck_id": "T1055",
          "attck_id_wiki": "https://attack.mitre.org/techniques/T1055"
        }
      },
      {
        "tactic": "Defense Evasion",
        "technique": "Thread Execution Hijacking",
        "attck_id": "T1055.003",
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1055/003",
        "malicious_identifiers_count": 0,
        "malicious_identifiers": [],
        "suspicious_identifiers_count": 1,
        "suspicious_identifiers": [],
        "informative_identifiers_count": 0,
        "informative_identifiers": [],
        "parent": {
          "technique": "Process Injection",
          "attck_id": "T1055",
          "attck_id_wiki": "https://attack.mitre.org/techniques/T1055"
        }
      },
      {
        "tactic": "Defense Evasion",
        "technique": "Process Injection",
        "attck_id": "T1055",
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1055",
        "malicious_identifiers_count": 0,
        "malicious_identifiers": [],
        "suspicious_identifiers_count": 0,
        "suspicious_identifiers": [],
        "informative_identifiers_count": 2,
        "informative_identifiers": [],
        "parent": null
      },
      {
        "tactic": "Defense Evasion",
        "technique": "File Deletion",
        "attck_id": "T1070.004",
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1070/004",
        "malicious_identifiers_count": 0,
        "malicious_identifiers": [],
        "suspicious_identifiers_count": 0,
        "suspicious_identifiers": [],
        "informative_identifiers_count": 1,
        "informative_identifiers": [],
        "parent": {
          "technique": "Indicator Removal",
          "attck_id": "T1070",
          "attck_id_wiki": "https://attack.mitre.org/techniques/T1070"
        }
      },
      {
        "tactic": "Defense Evasion",
        "technique": "Direct Volume Access",
        "attck_id": "T1006",
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1006",
        "malicious_identifiers_count": 0,
        "malicious_identifiers": [],
        "suspicious_identifiers_count": 0,
        "suspicious_identifiers": [],
        "informative_identifiers_count": 1,
        "informative_identifiers": [],
        "parent": null
      },
      {
        "tactic": "Defense Evasion",
        "technique": "Time Based Evasion",
        "attck_id": "T1497.003",
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1497/003",
        "malicious_identifiers_count": 0,
        "malicious_identifiers": [],
        "suspicious_identifiers_count": 0,
        "suspicious_identifiers": [],
        "informative_identifiers_count": 2,
        "informative_identifiers": [],
        "parent": {
          "technique": "Virtualization/Sandbox Evasion",
          "attck_id": "T1497",
          "attck_id_wiki": "https://attack.mitre.org/techniques/T1497"
        }
      },
      {
        "tactic": "Defense Evasion",
        "technique": "Software Packing",
        "attck_id": "T1027.002",
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1027/002",
        "malicious_identifiers_count": 0,
        "malicious_identifiers": [],
        "suspicious_identifiers_count": 3,
        "suspicious_identifiers": [],
        "informative_identifiers_count": 0,
        "informative_identifiers": [],
        "parent": {
          "technique": "Obfuscated Files or Information",
          "attck_id": "T1027",
          "attck_id_wiki": "https://attack.mitre.org/techniques/T1027"
        }
      },
      {
        "tactic": "Defense Evasion",
        "technique": "Extra Window Memory Injection",
        "attck_id": "T1055.011",
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1055/011",
        "malicious_identifiers_count": 0,
        "malicious_identifiers": [],
        "suspicious_identifiers_count": 1,
        "suspicious_identifiers": [],
        "informative_identifiers_count": 0,
        "informative_identifiers": [],
        "parent": {
          "technique": "Process Injection",
          "attck_id": "T1055",
          "attck_id_wiki": "https://attack.mitre.org/techniques/T1055"
        }
      },
      {
        "tactic": "Credential Access",
        "technique": "Credential API Hooking",
        "attck_id": "T1056.004",
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1056/004",
        "malicious_identifiers_count": 0,
        "malicious_identifiers": [],
        "suspicious_identifiers_count": 1,
        "suspicious_identifiers": [],
        "informative_identifiers_count": 0,
        "informative_identifiers": [],
        "parent": {
          "technique": "Input Capture",
          "attck_id": "T1056",
          "attck_id_wiki": "https://attack.mitre.org/techniques/T1056"
        }
      },
      {
        "tactic": "Discovery",
        "technique": "File and Directory Discovery",
        "attck_id": "T1083",
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1083",
        "malicious_identifiers_count": 0,
        "malicious_identifiers": [],
        "suspicious_identifiers_count": 0,
        "suspicious_identifiers": [],
        "informative_identifiers_count": 7,
        "informative_identifiers": [],
        "parent": null
      },
      {
        "tactic": "Discovery",
        "technique": "Process Discovery",
        "attck_id": "T1057",
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1057",
        "malicious_identifiers_count": 0,
        "malicious_identifiers": [],
        "suspicious_identifiers_count": 1,
        "suspicious_identifiers": [],
        "informative_identifiers_count": 4,
        "informative_identifiers": [],
        "parent": null
      },
      {
        "tactic": "Discovery",
        "technique": "Query Registry",
        "attck_id": "T1012",
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1012",
        "malicious_identifiers_count": 0,
        "malicious_identifiers": [],
        "suspicious_identifiers_count": 1,
        "suspicious_identifiers": [],
        "informative_identifiers_count": 4,
        "informative_identifiers": [],
        "parent": null
      },
      {
        "tactic": "Discovery",
        "technique": "System Service Discovery",
        "attck_id": "T1007",
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1007",
        "malicious_identifiers_count": 0,
        "malicious_identifiers": [],
        "suspicious_identifiers_count": 0,
        "suspicious_identifiers": [],
        "informative_identifiers_count": 1,
        "informative_identifiers": [],
        "parent": null
      },
      {
        "tactic": "Discovery",
        "technique": "System Information Discovery",
        "attck_id": "T1082",
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1082",
        "malicious_identifiers_count": 0,
        "malicious_identifiers": [],
        "suspicious_identifiers_count": 0,
        "suspicious_identifiers": [],
        "informative_identifiers_count": 9,
        "informative_identifiers": [],
        "parent": null
      },
      {
        "tactic": "Discovery",
        "technique": "System Language Discovery",
        "attck_id": "T1614.001",
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1614/001",
        "malicious_identifiers_count": 0,
        "malicious_identifiers": [],
        "suspicious_identifiers_count": 0,
        "suspicious_identifiers": [],
        "informative_identifiers_count": 1,
        "informative_identifiers": [],
        "parent": {
          "technique": "System Location Discovery",
          "attck_id": "T1614",
          "attck_id_wiki": "https://attack.mitre.org/techniques/T1614"
        }
      },
      {
        "tactic": "Discovery",
        "technique": "Debugger Evasion",
        "attck_id": "T1622",
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1622",
        "malicious_identifiers_count": 0,
        "malicious_identifiers": [],
        "suspicious_identifiers_count": 0,
        "suspicious_identifiers": [],
        "informative_identifiers_count": 2,
        "informative_identifiers": [],
        "parent": null
      },
      {
        "tactic": "Discovery",
        "technique": "System Owner/User Discovery",
        "attck_id": "T1033",
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1033",
        "malicious_identifiers_count": 0,
        "malicious_identifiers": [],
        "suspicious_identifiers_count": 0,
        "suspicious_identifiers": [],
        "informative_identifiers_count": 1,
        "informative_identifiers": [],
        "parent": null
      },
      {
        "tactic": "Discovery",
        "technique": "System Network Connections Discovery",
        "attck_id": "T1049",
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1049",
        "malicious_identifiers_count": 0,
        "malicious_identifiers": [],
        "suspicious_identifiers_count": 0,
        "suspicious_identifiers": [],
        "informative_identifiers_count": 1,
        "informative_identifiers": [],
        "parent": null
      },
      {
        "tactic": "Discovery",
        "technique": "System Network Configuration Discovery",
        "attck_id": "T1016",
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1016",
        "malicious_identifiers_count": 0,
        "malicious_identifiers": [],
        "suspicious_identifiers_count": 0,
        "suspicious_identifiers": [],
        "informative_identifiers_count": 1,
        "informative_identifiers": [],
        "parent": null
      },
      {
        "tactic": "Discovery",
        "technique": "Network Share Discovery",
        "attck_id": "T1135",
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1135",
        "malicious_identifiers_count": 0,
        "malicious_identifiers": [],
        "suspicious_identifiers_count": 0,
        "suspicious_identifiers": [],
        "informative_identifiers_count": 1,
        "informative_identifiers": [],
        "parent": null
      },
      {
        "tactic": "Discovery",
        "technique": "System Location Discovery",
        "attck_id": "T1614",
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1614",
        "malicious_identifiers_count": 0,
        "malicious_identifiers": [],
        "suspicious_identifiers_count": 0,
        "suspicious_identifiers": [],
        "informative_identifiers_count": 1,
        "informative_identifiers": [],
        "parent": null
      },
      {
        "tactic": "Discovery",
        "technique": "System Time Discovery",
        "attck_id": "T1124",
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1124",
        "malicious_identifiers_count": 0,
        "malicious_identifiers": [],
        "suspicious_identifiers_count": 0,
        "suspicious_identifiers": [],
        "informative_identifiers_count": 1,
        "informative_identifiers": [],
        "parent": null
      },
      {
        "tactic": "Discovery",
        "technique": "Time Based Evasion",
        "attck_id": "T1497.003",
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1497/003",
        "malicious_identifiers_count": 0,
        "malicious_identifiers": [],
        "suspicious_identifiers_count": 0,
        "suspicious_identifiers": [],
        "informative_identifiers_count": 2,
        "informative_identifiers": [],
        "parent": {
          "technique": "Virtualization/Sandbox Evasion",
          "attck_id": "T1497",
          "attck_id_wiki": "https://attack.mitre.org/techniques/T1497"
        }
      },
      {
        "tactic": "Lateral Movement",
        "technique": "Lateral Tool Transfer",
        "attck_id": "T1570",
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1570",
        "malicious_identifiers_count": 0,
        "malicious_identifiers": [],
        "suspicious_identifiers_count": 0,
        "suspicious_identifiers": [],
        "informative_identifiers_count": 1,
        "informative_identifiers": [],
        "parent": null
      },
      {
        "tactic": "Collection",
        "technique": "Credential API Hooking",
        "attck_id": "T1056.004",
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1056/004",
        "malicious_identifiers_count": 0,
        "malicious_identifiers": [],
        "suspicious_identifiers_count": 1,
        "suspicious_identifiers": [],
        "informative_identifiers_count": 0,
        "informative_identifiers": [],
        "parent": {
          "technique": "Input Capture",
          "attck_id": "T1056",
          "attck_id_wiki": "https://attack.mitre.org/techniques/T1056"
        }
      },
      {
        "tactic": "Collection",
        "technique": "Local Data Staging",
        "attck_id": "T1074.001",
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1074/001",
        "malicious_identifiers_count": 0,
        "malicious_identifiers": [],
        "suspicious_identifiers_count": 0,
        "suspicious_identifiers": [],
        "informative_identifiers_count": 1,
        "informative_identifiers": [],
        "parent": {
          "technique": "Data Staged",
          "attck_id": "T1074",
          "attck_id_wiki": "https://attack.mitre.org/techniques/T1074"
        }
      },
      {
        "tactic": "Command and Control",
        "technique": "Application Layer Protocol",
        "attck_id": "T1071",
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1071",
        "malicious_identifiers_count": 0,
        "malicious_identifiers": [],
        "suspicious_identifiers_count": 0,
        "suspicious_identifiers": [],
        "informative_identifiers_count": 1,
        "informative_identifiers": [],
        "parent": null
      },
      {
        "tactic": "Command and Control",
        "technique": "Ingress Tool Transfer",
        "attck_id": "T1105",
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1105",
        "malicious_identifiers_count": 0,
        "malicious_identifiers": [],
        "suspicious_identifiers_count": 0,
        "suspicious_identifiers": [],
        "informative_identifiers_count": 1,
        "informative_identifiers": [],
        "parent": null
      },
      {
        "tactic": "Exfiltration",
        "technique": "Scheduled Transfer",
        "attck_id": "T1029",
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1029",
        "malicious_identifiers_count": 0,
        "malicious_identifiers": [],
        "suspicious_identifiers_count": 0,
        "suspicious_identifiers": [],
        "informative_identifiers_count": 1,
        "informative_identifiers": [],
        "parent": null
      },
      {
        "tactic": "Impact",
        "technique": "Service Stop",
        "attck_id": "T1489",
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1489",
        "malicious_identifiers_count": 0,
        "malicious_identifiers": [],
        "suspicious_identifiers_count": 0,
        "suspicious_identifiers": [],
        "informative_identifiers_count": 1,
        "informative_identifiers": [],
        "parent": null
      }
    ],
    "network_mode": "default",
    "signatures": [
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "General",
        "identifier": "api-7",
        "type": 6,
        "relevance": 1,
        "name": "Loads modules at runtime",
        "description": "\"cmd.exe\" loaded module \"KERNEL32\" at base e8360000\n \"cmd.exe\" loaded module \"API-MS-WIN-CORE-STRING-L1-1-0\" at base e5170000\n \"cmd.exe\" loaded module \"API-MS-WIN-CORE-DATETIME-L1-1-1\" at base e5170000\n \"cmd.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0\" at base e5170000\n \"cmd.exe\" loaded module \"%WINDIR%\\SYSTEM32\\IMM32.DLL\" at base e5be0000\n \"cmd.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base e5170000\n \"cmd.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base e5170000\n \"cmd.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base e5170000\n \"cmd.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE64.DLL\" at base d3ef0000\n \"cmd.exe\" loaded module \"KERNEL32.DLL\" at base e8360000",
        "origin": "API Call",
        "attck_id": "T1129",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1129"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "General",
        "identifier": "api-175",
        "type": 6,
        "relevance": 1,
        "name": "Calls an API typically used to load libraries",
        "description": "\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004716)\n \"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004716)\n \"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004716)\n \"cmd.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00004716)",
        "origin": "API Call",
        "attck_id": "T1129",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1129"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "General",
        "identifier": "api-176",
        "type": 6,
        "relevance": 1,
        "name": "Calls an API typically used to retrieve function addresses",
        "description": "\"cmd.exe\" called \"GetProcAddress\" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter FlsAlloc (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter FlsSetValue (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter LCMapStringEx (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter FlsFree (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter InitOnceExecuteOnce (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter CreateEventExW (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreW (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreExW (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolTimer (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolTimer (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolTimer (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWait (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolWait (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWait (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter CreateSymbolicLinkW (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter GetCurrentPackageId (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter GetTickCount64 (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter SetFileInformationByHandle (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter InitializeConditionVariable (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter WakeConditionVariable (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter WakeAllConditionVariable (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableCS (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter InitializeSRWLock (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableSRW (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWork (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter SubmitThreadpoolWork (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWork (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter CompareStringEx (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter GetLocaleInfoEx (UID: 00000000-00004716)\n \"cmd.exe\" called \"GetProcAddress\" with a parameter AreFileApisANSI (UID: 00000000-00004716)",
        "origin": "API Call",
        "attck_id": "T1106",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1106"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "General",
        "identifier": "module-10",
        "type": 10,
        "relevance": 0,
        "name": "Loads the RPC (Remote Procedure Call) module DLL",
        "description": "\"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at E8420000",
        "origin": "Loaded Module",
        "attck_id": "T1129",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1129"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "General",
        "identifier": "module-9",
        "type": 10,
        "relevance": 0,
        "name": "Loads the Bcrypt module DLL",
        "description": "\"cmd.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at E55D0000",
        "origin": "Loaded Module",
        "attck_id": "T1027",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1027"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "General",
        "identifier": "registry-25",
        "type": 3,
        "relevance": 3,
        "name": "Reads information about supported languages",
        "description": "\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")",
        "origin": "Registry Access",
        "attck_id": "T1082",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1082"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "General",
        "identifier": "string-101",
        "type": 2,
        "relevance": 1,
        "name": "Contains ability to execute Windows APIs",
        "description": "Found reference to API (Indicator: \"SetConsoleInputExeNameW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"IsDebuggerPresent\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"CopyFileExW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"SetThreadUILanguage\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"NtQueryInformationProcess\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"RtlCreateUnicodeStringFromAsciiz\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"RtlNtStatusToDosError\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"NtSetInformationProcess\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"RtlFreeUnicodeString\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"RtlDosPathNameToRelativeNtPathName_U_WithStatus\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"NtSetInformationFile\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"RtlReleaseRelativeName\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"NtQueryVolumeInformationFile\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"NtOpenFile\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"RtlFindLeastSignificantBit\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"RtlDosPathNameToNtPathName_U\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"NtFsControlFile\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"RtlFreeHeap\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"RtlCaptureContext\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"RtlLookupFunctionEntry\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"RtlVirtualUnwind\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"CopyFileW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"ReadFile\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"SetThreadLocale\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"FindFirstFileW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetConsoleScreenBufferInfo\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"HeapFree\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetFullPathNameW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"FindNextFileW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetConsoleOutputCP\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetStdHandle\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetCPInfo\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"SetFilePointer\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"FindClose\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"CreateFileW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"MultiByteToWideChar\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetLastError\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"FillConsoleOutputCharacterW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"ReadConsoleW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"CloseHandle\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"ReleaseSRWLockShared\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"HeapAlloc\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"FlushConsoleInputBuffer\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"WriteConsoleW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetProcAddress\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"AcquireSRWLockShared\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetFileSize\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetProcessHeap\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetModuleHandleW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"WideCharToMultiByte\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetFileType\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"SetConsoleCursorPosition\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"RevertToSelf\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"VirtualQuery\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"SetLocalTime\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetLocaleInfoW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetUserDefaultLCID\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"FileTimeToSystemTime\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"FileTimeToLocalFileTime\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetLocalTime\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetTimeFormatW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"SystemTimeToFileTime\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetSystemTime\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetDateFormatW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetNumaHighestNodeNumber\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetCommandLineW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"SetConsoleMode\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"SetEnvironmentVariableW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetEnvironmentVariableW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"FreeEnvironmentStringsW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetConsoleMode\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"SetEnvironmentStringsW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetEnvironmentStringsW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetStartupInfoW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"RegQueryValueExW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"NeedCurrentDirectoryForExePathW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"SetLastError\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"RegDeleteValueW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"InitializeProcThreadAttributeList\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"CreateProcessAsUserW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"RegOpenKeyExW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"SetErrorMode\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetConsoleTitleW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetFileAttributesW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"RegSetValueExW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"RegEnumKeyExW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"UpdateProcThreadAttribute\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"RegCreateKeyExW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"DeleteProcThreadAttributeList\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"ReadProcessMemory\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"CreateProcessW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"RegDeleteKeyExW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"RegCloseKey\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"LoadLibraryExW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"MoveFileWithProgressW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"LocalFree\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"MoveFileExW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"SetConsoleTitleW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetVolumeInformationW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"SearchPathW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"WriteFile\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GlobalAlloc\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GlobalFree\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"SetFilePointerEx\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"SetConsoleCtrlHandler\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"EnterCriticalSection\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"TryAcquireSRWLockExclusive\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"ExpandEnvironmentStringsW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetModuleFileNameW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"LeaveCriticalSection\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"InitializeCriticalSection\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetVersion\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"ReleaseSRWLockExclusive\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetWindowsDirectoryW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetFileAttributesExW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetDriveTypeW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetCurrentThreadId\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"HeapSetInformation\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"OpenThread\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"VirtualFree\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"VirtualAlloc\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"HeapSize\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"HeapReAlloc\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"DuplicateHandle\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"FlushFileBuffers\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetACP\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"FormatMessageW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"SetConsoleTextAttribute\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"ScrollConsoleScreenBufferW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"FillConsoleOutputAttribute\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"CreateDirectoryW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"SetFileTime\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"SetEndOfFile\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"SetFileAttributesW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"DeleteFileW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"TerminateProcess\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"WaitForSingleObject\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"SetCurrentDirectoryW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetExitCodeProcess\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetCurrentDirectoryW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetFileInformationByHandleEx\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"RemoveDirectoryW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"CompareFileTime\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"DeviceIoControl\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetFileSecurityW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetSecurityDescriptorOwner\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetDiskFreeSpaceExW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"FindFirstFileExW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"ResumeThread\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetThreadGroupAffinity\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetNumaNodeProcessorMaskEx\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetThreadLocale\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"CreateHardLinkW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetVolumePathNameW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"CreateSymbolicLinkW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"Sleep\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"UnhandledExceptionFilter\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"SetUnhandledExceptionFilter\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetCurrentProcess\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"QueryPerformanceCounter\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetCurrentProcessId\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetSystemTimeAsFileTime\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"GetTickCount\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"lstrcmpiW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"lstrcmpW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"SetProcessAffinityMask\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"NtOpenProcessToken\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"NtQueryInformationToken\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"NtClose\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"NtOpenThreadToken\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"DelayLoadFailureHook\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API (Indicator: \"Beep\"; Source: \"00000000-00004716.00000000.77972.48F50000.00000002.mdmp, 00000000-00004716.00000001.79890.48F50000.00000002.mdmp, 00000000-00004716.00000002.81813.48F50000.00000002.mdmp\")\n Found reference to API (Indicator: \"SetConsoleInputExeNameW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"IsDebuggerPresent\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"CopyFileExW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"SetThreadUILanguage\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"NtQueryInformationProcess\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"RtlCreateUnicodeStringFromAsciiz\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"RtlNtStatusToDosError\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"NtSetInformationProcess\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"RtlFreeUnicodeString\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"RtlDosPathNameToRelativeNtPathName_U_WithStatus\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"NtSetInformationFile\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"RtlReleaseRelativeName\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"NtQueryVolumeInformationFile\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"NtOpenFile\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"RtlFindLeastSignificantBit\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"RtlDosPathNameToNtPathName_U\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"NtFsControlFile\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"RtlFreeHeap\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"RtlCaptureContext\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"RtlLookupFunctionEntry\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"RtlVirtualUnwind\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"CopyFileW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"ReadFile\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"SetThreadLocale\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"FindFirstFileW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetConsoleScreenBufferInfo\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"HeapFree\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetFullPathNameW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"FindNextFileW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetConsoleOutputCP\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetStdHandle\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetCPInfo\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"SetFilePointer\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"FindClose\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"CreateFileW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"MultiByteToWideChar\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetLastError\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"FillConsoleOutputCharacterW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"ReadConsoleW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"CloseHandle\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"ReleaseSRWLockShared\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"HeapAlloc\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"FlushConsoleInputBuffer\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"WriteConsoleW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetProcAddress\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"AcquireSRWLockShared\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetFileSize\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetProcessHeap\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetModuleHandleW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"WideCharToMultiByte\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetFileType\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"SetConsoleCursorPosition\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"RevertToSelf\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"VirtualQuery\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"SetLocalTime\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetLocaleInfoW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetUserDefaultLCID\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"FileTimeToSystemTime\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"FileTimeToLocalFileTime\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetLocalTime\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetTimeFormatW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"SystemTimeToFileTime\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetSystemTime\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetDateFormatW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetNumaHighestNodeNumber\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetCommandLineW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"SetConsoleMode\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"SetEnvironmentVariableW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetEnvironmentVariableW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"FreeEnvironmentStringsW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetConsoleMode\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"SetEnvironmentStringsW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetEnvironmentStringsW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetStartupInfoW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"RegQueryValueExW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"NeedCurrentDirectoryForExePathW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"SetLastError\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"RegDeleteValueW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"InitializeProcThreadAttributeList\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"CreateProcessAsUserW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"RegOpenKeyExW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"SetErrorMode\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetConsoleTitleW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetFileAttributesW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"RegSetValueExW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"RegEnumKeyExW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"UpdateProcThreadAttribute\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"RegCreateKeyExW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"DeleteProcThreadAttributeList\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"ReadProcessMemory\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"CreateProcessW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"RegDeleteKeyExW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"RegCloseKey\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"LoadLibraryExW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"MoveFileWithProgressW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"LocalFree\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"MoveFileExW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"SetConsoleTitleW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetVolumeInformationW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"SearchPathW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"WriteFile\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GlobalAlloc\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GlobalFree\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"SetFilePointerEx\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"SetConsoleCtrlHandler\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"EnterCriticalSection\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"TryAcquireSRWLockExclusive\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"ExpandEnvironmentStringsW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetModuleFileNameW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"LeaveCriticalSection\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"InitializeCriticalSection\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetVersion\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"ReleaseSRWLockExclusive\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetWindowsDirectoryW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetFileAttributesExW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetDriveTypeW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetCurrentThreadId\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"HeapSetInformation\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"OpenThread\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"VirtualFree\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"VirtualAlloc\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"HeapSize\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"HeapReAlloc\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"DuplicateHandle\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"FlushFileBuffers\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetACP\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"FormatMessageW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"SetConsoleTextAttribute\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"ScrollConsoleScreenBufferW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"FillConsoleOutputAttribute\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"CreateDirectoryW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"SetFileTime\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"SetEndOfFile\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"SetFileAttributesW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"DeleteFileW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"TerminateProcess\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"SetCurrentDirectoryW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetExitCodeProcess\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetCurrentDirectoryW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetFileInformationByHandleEx\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"RemoveDirectoryW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"CompareFileTime\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"DeviceIoControl\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetFileSecurityW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetSecurityDescriptorOwner\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetDiskFreeSpaceExW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"FindFirstFileExW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"ResumeThread\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetThreadGroupAffinity\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetNumaNodeProcessorMaskEx\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetThreadLocale\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"CreateHardLinkW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetVolumePathNameW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"CreateSymbolicLinkW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"Sleep\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"UnhandledExceptionFilter\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"SetUnhandledExceptionFilter\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetCurrentProcessId\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"GetTickCount\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"lstrcmpiW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"lstrcmpW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"SetProcessAffinityMask\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"NtOpenProcessToken\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"NtQueryInformationToken\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"NtClose\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"NtOpenThreadToken\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API (Indicator: \"DelayLoadFailureHook\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
        "origin": "File/Memory",
        "attck_id": "T1106",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1106"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "General",
        "identifier": "string-7",
        "type": 2,
        "relevance": 1,
        "name": "Contains PDB pathways",
        "description": "\"cmd.pdb\"",
        "origin": "File/Memory",
        "attck_id": null,
        "capec_id": null,
        "attck_id_wiki": null
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "General",
        "identifier": "string-240",
        "type": 2,
        "relevance": 1,
        "name": "Contains ability to execute an application (API string)",
        "description": "Found reference to API \"ShellExecuteWorker\" (Indicator: \"ShellExecute\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"ShellExecuteWorker\" (Indicator: \"ShellExecute\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
        "origin": "File/Memory",
        "attck_id": "T1106",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1106"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "General",
        "identifier": "string-315",
        "type": 2,
        "relevance": 1,
        "name": "Contains ability to create/open files (API string)",
        "description": "Found reference to API \"NtOpenFile\" (Indicator: \"NtOpenFile\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"NtOpenFile\" (Indicator: \"NtOpenFile\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
        "origin": "File/Memory",
        "attck_id": "T1106",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1106"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "General",
        "identifier": "string-220",
        "type": 2,
        "relevance": 1,
        "name": "Contains ability to create/control drivers (API string)",
        "description": "Found reference to API \"NtFsControlFile\" (Indicator: \"FsControlFile\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"NtFsControlFile\" (Indicator: \"FsControlFile\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
        "origin": "File/Memory",
        "attck_id": "T1543.003",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1543/003"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "General",
        "identifier": "string-319",
        "type": 2,
        "relevance": 1,
        "name": "Contains ability to set/get the last-error code for a calling thread (API string)",
        "description": "Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
        "origin": "File/Memory",
        "attck_id": "T1106",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1106"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "General",
        "identifier": "string-272",
        "type": 2,
        "relevance": 1,
        "name": "Contains ability to retrieve/open a process (API string)",
        "description": "Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
        "origin": "File/Memory",
        "attck_id": "T1057",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1057"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "General",
        "identifier": "string-206",
        "type": 2,
        "relevance": 1,
        "name": "Contains ability to retrieve the command-line string for the current process (API string)",
        "description": "Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
        "origin": "File/Memory",
        "attck_id": "T1059.003",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1059/003"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "General",
        "identifier": "string-204",
        "type": 2,
        "relevance": 1,
        "name": "Contains ability to create a new process (API string)",
        "description": "Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcess\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
        "origin": "File/Memory",
        "attck_id": "T1106",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1106"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "General",
        "identifier": "string-307",
        "type": 2,
        "relevance": 1,
        "name": "Contains ability to create/load registry keys (API string)",
        "description": "Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
        "origin": "File/Memory",
        "attck_id": "T1112",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1112"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "General",
        "identifier": "string-345",
        "type": 2,
        "relevance": 1,
        "name": "Contains ability to disable/close registry key (API string)",
        "description": "Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
        "origin": "File/Memory",
        "attck_id": "T1112",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1112"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "General",
        "identifier": "string-322",
        "type": 2,
        "relevance": 1,
        "name": "Contains ability to move file or directory (API string)",
        "description": "Found reference to API \"MoveFileWithProgressW\" (Indicator: \"MoveFile\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"MoveFileWithProgressW\" (Indicator: \"MoveFile\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
        "origin": "File/Memory",
        "attck_id": "T1570",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1570"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "General",
        "identifier": "string-161",
        "type": 2,
        "relevance": 1,
        "name": "Contains ability to retrieve/modify process thread (API string)",
        "description": "Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"NtOpenThreadToken\" (Indicator: \"OpenThread\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"NtOpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
        "origin": "File/Memory",
        "attck_id": "T1106",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1106"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "General",
        "identifier": "string-423",
        "type": 2,
        "relevance": 1,
        "name": "Contains ability to create directories (API string)",
        "description": "Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
        "origin": "File/Memory",
        "attck_id": "T1074.001",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1074/001"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "General",
        "identifier": "string-120",
        "type": 2,
        "relevance": 1,
        "name": "Contains registry location strings",
        "description": "\"Software\\Microsoft\\Command Processor\" in Source: 935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\n \"Software\\Policies\\Microsoft\\Windows\\System\" in Source: 935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\n \"Software\\Classes\" in Source: 935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\n \"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Keyboard Layout\" in Source: 00000000-00004716.00000000.77972.48F50000.00000002.mdmp\n 00000000-00004716.00000001.79890.48F50000.00000002.mdmp\n 00000000-00004716.00000002.81813.48F50000.00000002.mdmp\n \"Software\\Microsoft\\RegEdt32\" in Source: 00000000-00004716.00000000.77972.48F50000.00000002.mdmp\n 00000000-00004716.00000001.79890.48F50000.00000002.mdmp\n 00000000-00004716.00000002.81813.48F50000.00000002.mdmp\n \"SOFTWARE\\\\MICROSOFT\\\\CLOCK\" in Source: 00000000-00004716.00000000.77972.48F50000.00000002.mdmp\n 00000000-00004716.00000001.79890.48F50000.00000002.mdmp\n 00000000-00004716.00000002.81813.48F50000.00000002.mdmp\n \"Software\\Microsoft\\Windows NT\\CurrentVersion\\Devices\" in Source: 00000000-00004716.00000000.77972.48F50000.00000002.mdmp\n 00000000-00004716.00000001.79890.48F50000.00000002.mdmp\n 00000000-00004716.00000002.81813.48F50000.00000002.mdmp\n \"SOFTWARE\\\\MICROSOFT\\\\WINDOWS NT\\\\CURRENTVERSION\\\\EXTENSIONS\" in Source: 00000000-00004716.00000000.77972.48F50000.00000002.mdmp\n 00000000-00004716.00000001.79890.48F50000.00000002.mdmp\n 00000000-00004716.00000002.81813.48F50000.00000002.mdmp\n \"SOFTWARE\\\\MICROSOFT\\\\CHARMAP\" in Source: 00000000-00004716.00000000.77972.48F50000.00000002.mdmp\n 00000000-00004716.00000001.79890.48F50000.00000002.mdmp\n 00000000-00004716.00000002.81813.48F50000.00000002.mdmp\n \"SOFTWARE\\\\MICROSOFT\\\\WINDOWS NT\\\\CURRENTVERSION\\\\NETWORK\\\\PERSISTENT CONNECTIONS\" in Source: 00000000-00004716.00000000.77972.48F50000.00000002.mdmp\n 00000000-00004716.00000001.79890.48F50000.00000002.mdmp\n 00000000-00004716.00000002.81813.48F50000.00000002.mdmp\n \"Software\\Microsoft\\Windows NT\\CurrentVersion\\PrinterPorts\" in Source: 00000000-00004716.00000000.77972.48F50000.00000002.mdmp\n 00000000-00004716.00000001.79890.48F50000.00000002.mdmp\n 00000000-00004716.00000002.81813.48F50000.00000002.mdmp\n \"SOFTWARE\\\\MICROSOFT\\\\WINDOWS NT\\\\CURRENTVERSION\\\\TRUETYPE\" in Source: 00000000-00004716.00000000.77972.48F50000.00000002.mdmp\n 00000000-00004716.00000001.79890.48F50000.00000002.mdmp\n 00000000-00004716.00000002.81813.48F50000.00000002.mdmp\n \"SOFTWARE\\\\MICROSOFT\\\\WINDOWS NT\\\\CURRENTVERSION\\\\TWAIN\" in Source: 00000000-00004716.00000000.77972.48F50000.00000002.mdmp\n 00000000-00004716.00000001.79890.48F50000.00000002.mdmp\n 00000000-00004716.00000002.81813.48F50000.00000002.mdmp\n \"SOFTWARE\\\\MICROSOFT\\\\WINDOWS HELP\" in Source: 00000000-00004716.00000000.77972.48F50000.00000002.mdmp\n 00000000-00004716.00000001.79890.48F50000.00000002.mdmp\n 00000000-00004716.00000002.81813.48F50000.00000002.mdmp\n \"Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\" in Source: 00000000-00004716.00000000.77972.48F50000.00000002.mdmp\n 00000000-00004716.00000001.79890.48F50000.00000002.mdmp\n 00000000-00004716.00000002.81813.48F50000.00000002.mdmp\n \"Software\\Microsoft\\Command Processor\" in Source: 00000000-00004716.00000000.77972.49307000.00000002.mdmp\n 00000000-00004716.00000001.79890.49307000.00000002.mdmp\n 00000000-00004716.00000002.81813.49307000.00000002.mdmp\n \"Software\\Policies\\Microsoft\\Windows\\System\" in Source: 00000000-00004716.00000000.77972.49307000.00000002.mdmp\n 00000000-00004716.00000001.79890.49307000.00000002.mdmp\n 00000000-00004716.00000002.81813.49307000.00000002.mdmp\n \"Software\\Classes\" in Source: 00000000-00004716.00000000.77972.49307000.00000002.mdmp\n 00000000-00004716.00000001.79890.49307000.00000002.mdmp\n 00000000-00004716.00000002.81813.49307000.00000002.mdmp",
        "origin": "File/Memory",
        "attck_id": "T1012",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1012"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "General",
        "identifier": "static-157",
        "type": 0,
        "relevance": 0,
        "name": "Matched Compiler/Packer signature (DIE)",
        "description": "\"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\" was detected as \"Microsoft Visual C/C++\"  and name: \"Compiler\"\n \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\" was detected as \"Microsoft Linker\"  and name: \"Linker\"",
        "origin": "Static Parser",
        "attck_id": "T1027",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1027"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "General",
        "identifier": "static-93",
        "type": 0,
        "relevance": 1,
        "name": "PE file has a high image base",
        "description": "\"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\" has high imagebase  \"0x140000000\"",
        "origin": "Static Parser",
        "attck_id": null,
        "capec_id": null,
        "attck_id_wiki": null
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "General",
        "identifier": "static-154",
        "type": 0,
        "relevance": 0,
        "name": "File contains dynamic base/NX flags",
        "description": "\"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\" has flags like  IMAGE_DLLCHARACTERISTICS_GUARD_CF\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA",
        "origin": "Static Parser",
        "attck_id": null,
        "capec_id": null,
        "attck_id_wiki": null
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "General",
        "identifier": "static-96",
        "type": 0,
        "relevance": 0,
        "name": "PE file entrypoint instructions",
        "description": "\"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\" file has an entrypoint instructions - \"sub\trsp, 0x28,call\t0x1400156b4,add\trsp, 0x28,jmp\t0x140014fc0,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,nop\tword ptr [rax + rax],cmp\trcx, qword ptr [rip + 0x19e41],jne\t0x1400151d9,rol\trcx, 0x10,test\tcx, 0xffff,jne\t0x1400151d5,ret\t,ror\trcx, 0x10,jmp\t0x140015220,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,push\trbx,sub\trsp, 0x20,mov\trbx, rcx,xor\tecx, ecx,\"",
        "origin": "Static Parser",
        "attck_id": null,
        "capec_id": null,
        "attck_id_wiki": null
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "General",
        "identifier": "static-80",
        "type": 0,
        "relevance": 1,
        "name": "PE file contains executable sections",
        "description": "\"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\" has an executable section named \".text\"",
        "origin": "Static Parser",
        "attck_id": null,
        "capec_id": null,
        "attck_id_wiki": null
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "General",
        "identifier": "static-95",
        "type": 0,
        "relevance": 0,
        "name": "PE file contains writable sections",
        "description": "\"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\" has an writable section named \".data\"\n \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\" has an writable section named \".didat\"",
        "origin": "Static Parser",
        "attck_id": null,
        "capec_id": null,
        "attck_id_wiki": null
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "General",
        "identifier": "static-146",
        "type": 0,
        "relevance": 0,
        "name": "PE file contains Debug data directory",
        "description": "\"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"",
        "origin": "Static Parser",
        "attck_id": null,
        "capec_id": null,
        "attck_id_wiki": null
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "General",
        "identifier": "stream-103",
        "type": 1,
        "relevance": 3,
        "name": "Contains ability to delay the execution of current thread",
        "description": "Sleep at 61526-1-0000000140015190",
        "origin": "Hybrid Analysis Technology",
        "attck_id": "T1497.003",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1497/003"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "General",
        "identifier": "string-625",
        "type": 2,
        "relevance": 1,
        "name": "References Windows filepaths for DLLs (possible dropped files)",
        "description": "Observed system executable string:\"C:\\windows\\temp\\VxSSL64.dll\" [Source: 00000000-00004716.00000000.77972.67BF0000.00000020.mdmp\n 00000000-00004716.00000001.79890.67BF0000.00000020.mdmp\n 00000000-00004716.00000002.81813.67BF0000.00000020.mdmp]\n Observed system executable string:\"C:\\WINDOWS\\system32\\sxsoa.dll\" [Source: 00000000-00004716.00000000.77972.67C20000.00000002.mdmp\n 00000000-00004716.00000001.79890.67C20000.00000002.mdmp\n 00000000-00004716.00000002.81813.67C20000.00000002.mdmp]\n Observed system executable string:\"C:\\WINDOWS\\system32\\GdiPlus.dll\" [Source: 00000000-00004716.00000000.77972.67C20000.00000002.mdmp\n 00000000-00004716.00000001.79890.67C20000.00000002.mdmp\n 00000000-00004716.00000002.81813.67C20000.00000002.mdmp]\n Observed system executable string:\"C:\\WINDOWS\\system32\\comctl32.dll\" [Source: 00000000-00004716.00000000.77972.67C20000.00000002.mdmp\n 00000000-00004716.00000001.79890.67C20000.00000002.mdmp\n 00000000-00004716.00000002.81813.67C20000.00000002.mdmp]\n Observed system executable string:\"C:\\WINDOWS\\system32\\sxsoaps.dll\" [Source: 00000000-00004716.00000000.77972.67C20000.00000002.mdmp\n 00000000-00004716.00000001.79890.67C20000.00000002.mdmp\n 00000000-00004716.00000002.81813.67C20000.00000002.mdmp]\n Observed system executable string:\"C:\\WINDOWS\\system32\\comctl32.dll.mui\" [Source: 00000000-00004716.00000000.77972.67C20000.00000002.mdmp\n 00000000-00004716.00000001.79890.67C20000.00000002.mdmp\n 00000000-00004716.00000002.81813.67C20000.00000002.mdmp]\n Observed system executable string:\":\\WINDOWS\\SYSTEM32\\ntdll.dll\" [Source: 00000000-00004716.00000000.77972.69D30000.00000004.mdmp\n 00000000-00004716.00000001.79890.69D30000.00000004.mdmp\n 00000000-00004716.00000002.81813.69D30000.00000004.mdmp]\n Observed system executable string:\":\\WINDOWS\\System32\\KERNEL32.DLL\" [Source: 00000000-00004716.00000000.77972.69D30000.00000004.mdmp\n 00000000-00004716.00000001.79890.69D30000.00000004.mdmp\n 00000000-00004716.00000002.81813.69D30000.00000004.mdmp]\n Observed system executable string:\":\\WINDOWS\\System32\\msvcrt.dll\" [Source: 00000000-00004716.00000000.77972.69D30000.00000004.mdmp\n 00000000-00004716.00000001.79890.69D30000.00000004.mdmp\n 00000000-00004716.00000002.81813.69D30000.00000004.mdmp]\n Observed system executable string:\":\\WINDOWS\\System32\\KERNELBASE.dll\" [Source: 00000000-00004716.00000000.77972.69D30000.00000004.mdmp\n 00000000-00004716.00000001.79890.69D30000.00000004.mdmp\n 00000000-00004716.00000002.81813.69D30000.00000004.mdmp]\n Observed system executable string:\":\\windows\\temp\\VxSSL64.dll\" [Source: 00000000-00004716.00000000.77972.69D30000.00000004.mdmp\n 00000000-00004716.00000001.79890.69D30000.00000004.mdmp\n 00000000-00004716.00000002.81813.69D30000.00000004.mdmp]\n Observed system executable string:\":\\WINDOWS\\System32\\WS2_32.dll\" [Source: 00000000-00004716.00000000.77972.69D30000.00000004.mdmp\n 00000000-00004716.00000001.79890.69D30000.00000004.mdmp\n 00000000-00004716.00000002.81813.69D30000.00000004.mdmp]\n Observed system executable string:\"C:\\windows\\temp\\VxOle64.dll\" [Source: 00000000-00004716.00000000.77972.69D30000.00000004.mdmp\n 00000000-00004716.00000000.77972.69E40000.00000020.mdmp\n 00000000-00004716.00000000.77972.69E70000.00000002.mdmp\n 00000000-00004716.00000001.79890.69D30000.00000004.mdmp\n 00000000-00004716.00000001.79890.69E40000.00000020.mdmp\n 00000000-00004716.00000001.79890.69E70000.00000002.mdmp\n 00000000-00004716.00000002.81813.69D30000.00000004.mdmp\n 00000000-00004716.00000002.81813.69E40000.00000020.mdmp\n 00000000-00004716.00000002.81813.69E70000.00000002.mdmp]\n Observed system executable string:\":\\WINDOWS\\System32\\RPCRT4.dll\" [Source: 00000000-00004716.00000000.77972.69D30000.00000004.mdmp\n 00000000-00004716.00000001.79890.69D30000.00000004.mdmp\n 00000000-00004716.00000002.81813.69D30000.00000004.mdmp]\n Observed system executable string:\":\\WINDOWS\\SYSTEM32\\FLTLIB.DLL\" [Source: 00000000-00004716.00000000.77972.69D30000.00000004.mdmp\n 00000000-00004716.00000001.79890.69D30000.00000004.mdmp\n 00000000-00004716.00000002.81813.69D30000.00000004.mdmp]\n Observed system executable string:\"C:\\WINDOWS\\SYSTEM32\\gdi32full.dll\" [Source: 00000000-00004716.00000000.77972.69D30000.00000004.mdmp\n 00000000-00004716.00000001.79890.69D30000.00000004.mdmp\n 00000000-00004716.00000002.81813.69D30000.00000004.mdmp]\n Observed system executable string:\":\\WINDOWS\\System32\\ucrtbase.dll\" [Source: 00000000-00004716.00000000.77972.69D30000.00000004.mdmp\n 00000000-00004716.00000001.79890.69D30000.00000004.mdmp\n 00000000-00004716.00000002.81813.69D30000.00000004.mdmp]\n Observed system executable string:\":\\WINDOWS\\System32\\USER32.dll\" [Source: 00000000-00004716.00000000.77972.69D30000.00000004.mdmp\n 00000000-00004716.00000001.79890.69D30000.00000004.mdmp\n 00000000-00004716.00000002.81813.69D30000.00000004.mdmp]\n Observed system executable string:\":\\WINDOWS\\System32\\ADVAPI32.dll\" [Source: 00000000-00004716.00000000.77972.69D30000.00000004.mdmp\n 00000000-00004716.00000001.79890.69D30000.00000004.mdmp\n 00000000-00004716.00000002.81813.69D30000.00000004.mdmp]\n Observed system executable string:\":\\WINDOWS\\System32\\ole32.dll\" [Source: 00000000-00004716.00000000.77972.69D30000.00000004.mdmp\n 00000000-00004716.00000001.79890.69D30000.00000004.mdmp\n 00000000-00004716.00000002.81813.69D30000.00000004.mdmp]\n Observed system executable string:\":\\WINDOWS\\System32\\GDI32.dll\" [Source: 00000000-00004716.00000000.77972.69D30000.00000004.mdmp\n 00000000-00004716.00000001.79890.69D30000.00000004.mdmp\n 00000000-00004716.00000002.81813.69D30000.00000004.mdmp]\n Observed system executable string:\":\\WINDOWS\\System32\\gdi32full.dll\" [Source: 00000000-00004716.00000000.77972.69D30000.00000004.mdmp\n 00000000-00004716.00000001.79890.69D30000.00000004.mdmp\n 00000000-00004716.00000002.81813.69D30000.00000004.mdmp]\n Observed system executable string:\":\\WINDOWS\\System32\\combase.dll\" [Source: 00000000-00004716.00000000.77972.69D30000.00000004.mdmp\n 00000000-00004716.00000001.79890.69D30000.00000004.mdmp\n 00000000-00004716.00000002.81813.69D30000.00000004.mdmp]\n Observed system executable string:\":\\WINDOWS\\System32\\msvcp_win.dll\" [Source: 00000000-00004716.00000000.77972.69D30000.00000004.mdmp\n 00000000-00004716.00000001.79890.69D30000.00000004.mdmp\n 00000000-00004716.00000002.81813.69D30000.00000004.mdmp]\n Observed system executable string:\":\\WINDOWS\\System32\\sechost.dll\" [Source: 00000000-00004716.00000000.77972.69D30000.00000004.mdmp\n 00000000-00004716.00000001.79890.69D30000.00000004.mdmp\n 00000000-00004716.00000002.81813.69D30000.00000004.mdmp]",
        "origin": "File/Memory",
        "attck_id": "T1083",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1083"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "Unusual Characteristics",
        "identifier": "registry-26",
        "type": 3,
        "relevance": 2,
        "name": "Reads the windows installation language",
        "description": "\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")",
        "origin": "Registry Access",
        "attck_id": "T1614.001",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1614/001"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "Installation/Persistence",
        "identifier": "api-126",
        "type": 6,
        "relevance": 3,
        "name": "Tries to access non-existent files (executable)",
        "description": "\"cmd.exe\" trying to access non-existent file \"C:\\FLTLIB.DLL\"\n \"cmd.exe\" trying to access non-existent file \"C:\\NETMSG.DLL\"\n \"cmd.exe\" trying to access non-existent file \"C:\\netmsg.dll\"",
        "origin": "API Call",
        "attck_id": "T1083",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1083"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "Installation/Persistence",
        "identifier": "api-263",
        "type": 6,
        "relevance": 1,
        "name": "Touches files",
        "description": "\"cmd.exe\" trying to touch file \"C:\\FLTLIB.DLL\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\fltLib.dll\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"cmd.exe\" trying to touch file \"C:\\windows\\temp\\VxOle64.dll\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"\n \"cmd.exe\" trying to touch file \"C:\\WINDOWS\\system32\\IMM32.DLL\"\n \"cmd.exe\" trying to touch file \"C:\\EN-US\\CMD.EXE.MUI\"\n \"cmd.exe\" trying to touch file \"C:\\EN\\CMD.EXE.MUI\"\n \"cmd.exe\" trying to touch file \"C:\\cmd.exe\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\oleaut32.dll\"",
        "origin": "API Call",
        "attck_id": "T1083",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1083"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "Installation/Persistence",
        "identifier": "api-235",
        "type": 6,
        "relevance": 1,
        "name": "Queries basic information of the specified process",
        "description": "\"cmd.exe\" queries basic process information of the  \"C:\\cmd.exe\" (UID: 4716)",
        "origin": "API Call",
        "attck_id": "T1057",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1057"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "Installation/Persistence",
        "identifier": "registry-177",
        "type": 3,
        "relevance": 1,
        "name": "Opens registry keys",
        "description": "\"cmd.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\\SEGMENT HEAP\"; Key: \"\"; Value: \"\")\n \"cmd.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\"; Key: \"\"; Value: \"\")\n \"cmd.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\IMAGE FILE EXECUTION OPTIONS\\CONHOST.EXE\"; Key: \"\"; Value: \"\")\n \"cmd.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\"; Value: \"\")\n \"cmd.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\\BAM\"; Key: \"\"; Value: \"\")\n \"cmd.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SAFEBOOT\\OPTION\"; Key: \"\"; Value: \"\")\n \"cmd.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SRP\\GP\\DLL\"; Key: \"\"; Value: \"\")\n \"cmd.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"\"; Value: \"\")\n \"cmd.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"\"; Value: \"\")\n \"cmd.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\FILESYSTEM\"; Key: \"\"; Value: \"\")\n \"cmd.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\SORTING\\VERSIONS\"; Key: \"\"; Value: \"\")\n \"cmd.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\\MUICACHED\\MACHINELANGUAGECONFIGURATION\"; Key: \"\"; Value: \"\")\n \"cmd.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\MUI\\SETTINGS\"; Key: \"\"; Value: \"\")\n \"cmd.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\CONTROL PANEL\\DESKTOP\"; Key: \"\"; Value: \"\")\n \"cmd.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\\LANGUAGECONFIGURATION\"; Key: \"\"; Value: \"\")",
        "origin": "Registry Access",
        "attck_id": "T1012",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1012"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "Installation/Persistence",
        "identifier": "registry-172",
        "type": 3,
        "relevance": 1,
        "name": "Queries registry keys",
        "description": "\"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\"; Key: \"RESOURCEPOLICIES\"; Value: \"\")\n \"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CONHOST.EXE\"; Value: \"\")\n \"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\"; Value: \"\")\n \"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\FILESYSTEM\"; Key: \"LONGPATHSENABLED\"; Value: \"\")\n \"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\SORTING\\VERSIONS\"; Key: \"\"; Value: \"\")\n \"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\"; Key: \"PREFERREDUILANGUAGES\"; Value: \"\")\n \"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\\MUICACHED\"; Key: \"MACHINEPREFERREDUILANGUAGES\"; Value: \"\")\n \"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\SIDEBYSIDE\"; Key: \"PREFEREXTERNALMANIFEST\"; Value: \"\")\n \"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\"; Key: \"SAFEDLLSEARCHMODE\"; Value: \"\")\n \"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\LSA\\FIPSALGORITHMPOLICY\"; Key: \"ENABLED\"; Value: \"\")\n \"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\LSA\"; Key: \"FIPSALGORITHMPOLICY\"; Value: \"\")\n \"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\LSA\\FIPSALGORITHMPOLICY\"; Key: \"MDMENABLED\"; Value: \"\")\n \"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\OLE\"; Key: \"PAGEALLOCATORUSESYSTEMHEAP\"; Value: \"\")\n \"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\OLE\"; Key: \"PAGEALLOCATORSYSTEMHEAPISPRIVATE\"; Value: \"\")\n \"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\OLE\"; Key: \"AGGRESSIVEMTATESTING\"; Value: \"\")\n \"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\GRE_INITIALIZE\"; Key: \"DISABLEMETAFILES\"; Value: \"\")\n \"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\"; Key: \"ENABLEPERPROCESSSYSTEMDPI\"; Value: \"\")\n \"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\COMPATIBILITY32\"; Key: \"CMD\"; Value: \"\")\n \"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CMF\\CONFIG\"; Key: \"SYSTEM\"; Value: \"\")\n \"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\WINDOWS\"; Key: \"LOADAPPINIT_DLLS\"; Value: \"\")\n \"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SYSTEM\"; Key: \"DISABLECMD\"; Value: \"\")",
        "origin": "Registry Access",
        "attck_id": "T1012",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1012"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "Installation/Persistence",
        "identifier": "string-310",
        "type": 2,
        "relevance": 1,
        "name": "Contains ability to load modules (API string)",
        "description": "Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
        "origin": "File/Memory",
        "attck_id": "T1106",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1106"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "Installation/Persistence",
        "identifier": "string-443",
        "type": 2,
        "relevance": 1,
        "name": "Contains registry location which perform auto-execute functionality",
        "description": "Found string \"Software\\Microsoft\\Command Processor\" (Indicator: \"software\\microsoft\\command processor\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found string \"Software\\Microsoft\\Command Processor\" (Indicator: \"software\\microsoft\\command processor\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
        "origin": "File/Memory",
        "attck_id": "T1547.001",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1547/001"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "Anti-Detection/Stealthyness",
        "identifier": "string-304",
        "type": 2,
        "relevance": 1,
        "name": "Contains ability to modify registry key/value (API string)",
        "description": "Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
        "origin": "File/Memory",
        "attck_id": "T1112",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1112"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "Anti-Detection/Stealthyness",
        "identifier": "string-318",
        "type": 2,
        "relevance": 1,
        "name": "Contains ability to load/free library (API string)",
        "description": "Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
        "origin": "File/Memory",
        "attck_id": "T1055.001",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1055/001"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "Anti-Detection/Stealthyness",
        "identifier": "string-92",
        "type": 2,
        "relevance": 1,
        "name": "Contains ability to inject code into another process (API string)",
        "description": "Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
        "origin": "File/Memory",
        "attck_id": "T1055",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1055"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "Anti-Detection/Stealthyness",
        "identifier": "string-409",
        "type": 2,
        "relevance": 1,
        "name": "Contains ability to set file time (API string)",
        "description": "Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
        "origin": "File/Memory",
        "attck_id": "T1070.006",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1070/006"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "Anti-Detection/Stealthyness",
        "identifier": "string-226",
        "type": 2,
        "relevance": 1,
        "name": "Contains ability to delay execution by waiting for signal/timeout (API string)",
        "description": "Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
        "origin": "File/Memory",
        "attck_id": null,
        "capec_id": null,
        "attck_id_wiki": null
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "Anti-Detection/Stealthyness",
        "identifier": "string-306",
        "type": 2,
        "relevance": 1,
        "name": "Contains ability to impersonate access tokens (API string)",
        "description": "Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"NtOpenThreadToken\" (Indicator: \"OpenThreadToken\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"NtOpenThreadToken\" (Indicator: \"OpenThreadToken\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
        "origin": "File/Memory",
        "attck_id": "T1134.001",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1134/001"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "Anti-Detection/Stealthyness",
        "identifier": "memorydump-8",
        "type": 20,
        "relevance": 1,
        "name": "Found PE header in memory",
        "description": "Found PE header \"MZ\" - Source: \"00000000-00004716.00000000.77972.492E0000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00004716.00000001.79890.492E0000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00004716.00000002.81813.492E0000.00000002.mdmp\")",
        "origin": "Memory Dumps",
        "attck_id": "T1055",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1055"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "Anti-Reverse Engineering",
        "identifier": "string-183",
        "type": 2,
        "relevance": 1,
        "name": "Contains ability to check debugger is running (API string)",
        "description": "Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"NtQueryInformationProcess\" (Indicator: \"NtQueryInformationProcess\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")",
        "origin": "File/Memory",
        "attck_id": "T1622",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1622"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "Anti-Reverse Engineering",
        "identifier": "string-148",
        "type": 2,
        "relevance": 1,
        "name": "Contains ability to register a top-level exception handler (API string)",
        "description": "Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")",
        "origin": "File/Memory",
        "attck_id": "T1622",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1622"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "Environment Awareness",
        "identifier": "registry-78",
        "type": 3,
        "relevance": 1,
        "name": "Contains ability to read software policies",
        "description": "\"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")",
        "origin": "Registry Access",
        "attck_id": "T1082",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1082"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "Environment Awareness",
        "identifier": "string-222",
        "type": 2,
        "relevance": 1,
        "name": "Contains ability to retrieve network parameters of a computer (API string)",
        "description": "Found reference to API \"WNetGetConnectionWStub\" (Indicator: \"NetGetConnection\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"WNetGetConnectionWStub\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
        "origin": "File/Memory",
        "attck_id": "T1016",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1016"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "Environment Awareness",
        "identifier": "string-89",
        "type": 2,
        "relevance": 1,
        "name": "Contains ability to retrieve information about the current system (API string)",
        "description": "Found reference to API \"RtlNtStatusToDosError\" (Indicator: \"RtlNtStatusToDosError\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"ExpandEnvironmentStringsW\" (Indicator: \"ExpandEnvironmentStrings\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"RtlNtStatusToDosError\" (Indicator: \"RtlNtStatusToDosError\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"ExpandEnvironmentStringsW\" (Indicator: \"ExpandEnvironmentStrings\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
        "origin": "File/Memory",
        "attck_id": "T1082",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1082"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "Environment Awareness",
        "identifier": "string-162",
        "type": 2,
        "relevance": 1,
        "name": "Contains ability to retrieve volume information (API string)",
        "description": "Found reference to API \"NtQueryVolumeInformationFile\" (Indicator: \"NtQueryVolumeInformationFile\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"NtQueryVolumeInformationFile\" (Indicator: \"NtQueryVolumeInformationFile\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
        "origin": "File/Memory",
        "attck_id": "T1082",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1082"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "Environment Awareness",
        "identifier": "string-201",
        "type": 2,
        "relevance": 1,
        "name": "Contains ability to query system locale (API string)",
        "description": "Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
        "origin": "File/Memory",
        "attck_id": "T1614",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1614"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "Environment Awareness",
        "identifier": "string-249",
        "type": 2,
        "relevance": 1,
        "name": "Contains ability to retrieve file time (API string)",
        "description": "Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"FileTimeToLocalFileTime\" (Indicator: \"FileTimeToLocalFileTime\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"FileTimeToLocalFileTime\" (Indicator: \"FileTimeToLocalFileTime\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
        "origin": "File/Memory",
        "attck_id": "T1070.006",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1070/006"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "Environment Awareness",
        "identifier": "string-365",
        "type": 2,
        "relevance": 1,
        "name": "Contains ability to perform scheduled transfer (API string)",
        "description": "Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
        "origin": "File/Memory",
        "attck_id": "T1029",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1029"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "Environment Awareness",
        "identifier": "string-247",
        "type": 2,
        "relevance": 1,
        "name": "Contains ability to retrieve machine time (API string)",
        "description": "Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
        "origin": "File/Memory",
        "attck_id": "T1124",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1124"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "Environment Awareness",
        "identifier": "string-167",
        "type": 2,
        "relevance": 1,
        "name": "Contains ability to retrieve the contents of the STARTUPINFO structure (API string)",
        "description": "Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")",
        "origin": "File/Memory",
        "attck_id": "T1543",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1543"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "Environment Awareness",
        "identifier": "string-171",
        "type": 2,
        "relevance": 1,
        "name": "Contains ability to retrieve the OS information (API string)",
        "description": "Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
        "origin": "File/Memory",
        "attck_id": "T1082",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1082"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "Environment Awareness",
        "identifier": "string-312",
        "type": 2,
        "relevance": 1,
        "name": "Contains ability to retrieve path in which Windows is installed (API string)",
        "description": "Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
        "origin": "File/Memory",
        "attck_id": "T1083",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1083"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "Environment Awareness",
        "identifier": "string-193",
        "type": 2,
        "relevance": 1,
        "name": "Contains ability to query volume/memory size (API string)",
        "description": "Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
        "origin": "File/Memory",
        "attck_id": "T1082",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1082"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "Environment Awareness",
        "identifier": "string-194",
        "type": 2,
        "relevance": 1,
        "name": "Contains the ability to enumerate volumes (API string)",
        "description": "Found reference to API \"GetVolumePathNameW\" (Indicator: \"GetVolumePathName\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetVolumePathNameW\" (Indicator: \"GetVolumePathName\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
        "origin": "File/Memory",
        "attck_id": "T1006",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1006"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "Spyware/Information Retrieval",
        "identifier": "api-103",
        "type": 6,
        "relevance": 3,
        "name": "Calls an API typically used for taking snapshot of the specified processes",
        "description": "\"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}",
        "origin": "API Call",
        "attck_id": "T1057",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1057"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "Spyware/Information Retrieval",
        "identifier": "string-85",
        "type": 2,
        "relevance": 1,
        "name": "Contains ability to enumerate process and/or its information (API string)",
        "description": "Found reference to API \"NtQueryInformationProcess\" (Indicator: \"QueryInformationProcess\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"NtQueryInformationProcess\" (Indicator: \"QueryInformationProcess\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
        "origin": "File/Memory",
        "attck_id": "T1057",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1057"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "Spyware/Information Retrieval",
        "identifier": "string-121",
        "type": 2,
        "relevance": 1,
        "name": "Contains ability to retrieve usernames and/or user information (API string)",
        "description": "Found reference to API \"NtQueryInformationProcess\" (Indicator: \"NtQueryInformationProcess\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"LookupAccountSidWStub\" (Indicator: \"LookupAccountSid\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"NtOpenProcessToken\" (Indicator: \"NtOpenProcessToken\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"NtQueryInformationToken\" (Indicator: \"NtQueryInformationToken\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"NtOpenThreadToken\" (Indicator: \"NtOpenThreadToken\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"NtQueryInformationProcess\" (Indicator: \"NtQueryInformationProcess\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"LookupAccountSidWStub\" (Indicator: \"LookupAccountSid\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"NtOpenProcessToken\" (Indicator: \"NtOpenProcessToken\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"NtQueryInformationToken\" (Indicator: \"NtQueryInformationToken\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"NtOpenThreadToken\" (Indicator: \"NtOpenThreadToken\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
        "origin": "File/Memory",
        "attck_id": "T1033",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1033"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "Spyware/Information Retrieval",
        "identifier": "string-534",
        "type": 2,
        "relevance": 0,
        "name": "Contains ability to read files (API string)",
        "description": "Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
        "origin": "File/Memory",
        "attck_id": "T1083",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1083"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "Spyware/Information Retrieval",
        "identifier": "string-83",
        "type": 2,
        "relevance": 1,
        "name": "Contains ability to enumerate files on disk (API string)",
        "description": "Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
        "origin": "File/Memory",
        "attck_id": "T1083",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1083"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "Spyware/Information Retrieval",
        "identifier": "string-317",
        "type": 2,
        "relevance": 1,
        "name": "Contains ability to retrieve address of exported function from a DLL (API string)",
        "description": "Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
        "origin": "File/Memory",
        "attck_id": "T1106",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1106"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "Spyware/Information Retrieval",
        "identifier": "string-207",
        "type": 2,
        "relevance": 1,
        "name": "Contains ability to retrieve file and directory information (API string)",
        "description": "Found reference to API \"GetFileSize\" (Indicator: \"GetFileSize\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetFileAttributesExW\" (Indicator: \"GetFileAttributes\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetCurrentDirectoryW\" (Indicator: \"GetCurrentDirectory\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetFileInformationByHandleEx\" (Indicator: \"GetFileInformationByHandle\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetFileSize\" (Indicator: \"GetFileSize\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"GetFileAttributesExW\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"GetCurrentDirectoryW\" (Indicator: \"GetCurrentDirectory\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"GetFileInformationByHandleEx\" (Indicator: \"GetFileInformationByHandle\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
        "origin": "File/Memory",
        "attck_id": "T1083",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1083"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "Spyware/Information Retrieval",
        "identifier": "string-427",
        "type": 2,
        "relevance": 1,
        "name": "Contains ability to retrieve a module handle (API string)",
        "description": "Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
        "origin": "File/Memory",
        "attck_id": "T1082",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1082"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "Spyware/Information Retrieval",
        "identifier": "string-107",
        "type": 2,
        "relevance": 1,
        "name": "Contains ability to retrieve the host's architecture (API string)",
        "description": "Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
        "origin": "File/Memory",
        "attck_id": "T1082",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1082"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "Spyware/Information Retrieval",
        "identifier": "string-229",
        "type": 2,
        "relevance": 1,
        "name": "Contains ability to query registry keys (API string)",
        "description": "Found reference to API \"RegQueryValueExW\" (Indicator: \"RegQueryValue\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"RegOpenKeyExW\" (Indicator: \"RegOpenKey\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"RegEnumKeyExW\" (Indicator: \"RegEnumKey\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"RegQueryValueExW\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"RegOpenKeyExW\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"RegEnumKeyExW\" (Indicator: \"RegEnumKey\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
        "origin": "File/Memory",
        "attck_id": "T1012",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1012"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "Spyware/Information Retrieval",
        "identifier": "string-164",
        "type": 2,
        "relevance": 1,
        "name": "Contains ability to retrieve the fully qualified path of module (API string)",
        "description": "Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
        "origin": "File/Memory",
        "attck_id": "T1106",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1106"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "Spyware/Information Retrieval",
        "identifier": "string-80",
        "type": 2,
        "relevance": 1,
        "name": "Contains ability to determine disk drive type (API string)",
        "description": "Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
        "origin": "File/Memory",
        "attck_id": "T1082",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1082"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "Spyware/Information Retrieval",
        "identifier": "string-205",
        "type": 2,
        "relevance": 1,
        "name": "Contains ability to retrieve the time elapsed since the system was started (API string)",
        "description": "Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
        "origin": "File/Memory",
        "attck_id": "T1497.003",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1497/003"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "Network Related",
        "identifier": "string-3",
        "type": 2,
        "relevance": 3,
        "name": "Found potential URL in binary/memory",
        "description": "Heuristic match: \"fD9.tH\"\n Pattern match: \"http://schemas.microsoft.com/SMI/2005/WindowsSettings\"\n Heuristic match: \"(s.IL\"",
        "origin": "File/Memory",
        "attck_id": "T1071",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1071"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "Network Related",
        "identifier": "string-257",
        "type": 2,
        "relevance": 1,
        "name": "Contains ability to enumerate network resources (API string)",
        "description": "Found reference to API \"WNetGetConnectionWStub\" (Indicator: \"NetGetConnection\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"WNetAddConnection2WStub\" (Indicator: \"NetAddConnection\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"WNetGetConnectionWStub\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"WNetAddConnection2WStub\" (Indicator: \"NetAddConnection\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
        "origin": "File/Memory",
        "attck_id": "T1049",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1049"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "Network Related",
        "identifier": "string-113",
        "type": 2,
        "relevance": 1,
        "name": "Contains ability to provide information and utilities for managing network resources (API string)",
        "description": "Found reference to API \"WNetCancelConnection2WStub\" (Indicator: \"WNetCancelConnection\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")",
        "origin": "File/Memory",
        "attck_id": "T1135",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1135"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "System Security",
        "identifier": "registry-173",
        "type": 3,
        "relevance": 1,
        "name": "Queries services related registry keys",
        "description": "\"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CONHOST.EXE\"; Value: \"\")",
        "origin": "Registry Access",
        "attck_id": "T1007",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1007"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "System Security",
        "identifier": "string-426",
        "type": 2,
        "relevance": 1,
        "name": "Contains ability to modify file attributes (API string)",
        "description": "Found reference to API \"NtSetInformationFile\" (Indicator: \"SetInformationFile\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"NtSetInformationFile\" (Indicator: \"NtSetInformationFile\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"NtSetInformationFile\" (Indicator: \"SetInformationFile\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"NtSetInformationFile\" (Indicator: \"NtSetInformationFile\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
        "origin": "File/Memory",
        "attck_id": "T1222",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1222"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "System Security",
        "identifier": "string-114",
        "type": 2,
        "relevance": 1,
        "name": "Contains ability to obtains specified information about the security of a file or directory (API string)",
        "description": "Found reference to API \"RevertToSelf\" (Indicator: \"RevertToSelf\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetFileSecurityW\" (Indicator: \"GetFileSecurityW\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"GetSecurityDescriptorOwner\" (Indicator: \"GetSecurityDescriptorOwner\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"RevertToSelf\" (Indicator: \"RevertToSelf\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"GetFileSecurityW\" (Indicator: \"GetFileSecurityW\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"GetSecurityDescriptorOwner\" (Indicator: \"GetSecurityDescriptorOwner\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
        "origin": "File/Memory",
        "attck_id": "T1134.001",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1134/001"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "System Security",
        "identifier": "string-230",
        "type": 2,
        "relevance": 1,
        "name": "Contains ability to delete registry key/value (API string)",
        "description": "Found reference to API \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"RegDeleteKeyExW\" (Indicator: \"RegDeleteKey\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"RegDeleteKeyExW\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
        "origin": "File/Memory",
        "attck_id": "T1112",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1112"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "System Security",
        "identifier": "string-402",
        "type": 2,
        "relevance": 1,
        "name": "Contains ability to modify process attributes (API string)",
        "description": "Found reference to API \"InitializeProcThreadAttributeList\" (Indicator: \"InitializeProcThreadAttributeList\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"UpdateProcThreadAttribute\" (Indicator: \"UpdateProcThreadAttribute\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"InitializeProcThreadAttributeList\" (Indicator: \"InitializeProcThreadAttributeList\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"UpdateProcThreadAttribute\" (Indicator: \"UpdateProcThreadAttribute\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
        "origin": "File/Memory",
        "attck_id": "T1562.001",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1562/001"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "System Security",
        "identifier": "string-168",
        "type": 2,
        "relevance": 1,
        "name": "Contains ability to create process with token (API string)",
        "description": "Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcessAsUser\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")",
        "origin": "File/Memory",
        "attck_id": "T1134.002",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1134/002"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "System Security",
        "identifier": "string-535",
        "type": 2,
        "relevance": 0,
        "name": "Contains ability to write files (API string)",
        "description": "Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
        "origin": "File/Memory",
        "attck_id": "T1105",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1105"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "System Security",
        "identifier": "string-308",
        "type": 2,
        "relevance": 1,
        "name": "Contains ability to delete files/directories (API string)",
        "description": "Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
        "origin": "File/Memory",
        "attck_id": "T1070.004",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1070/004"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "System Security",
        "identifier": "string-316",
        "type": 2,
        "relevance": 1,
        "name": "Contains ability to terminate a process (API string)",
        "description": "Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00004716.00000000.77972.49307000.00000002.mdmp, 00000000-00004716.00000001.79890.49307000.00000002.mdmp, 00000000-00004716.00000002.81813.49307000.00000002.mdmp\")",
        "origin": "File/Memory",
        "attck_id": "T1489",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1489"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "System Security",
        "identifier": "static-87",
        "type": 0,
        "relevance": 1,
        "name": "Imports system security related APIs",
        "description": "Observed import api \"GetFileSecurityW\" which can \"Obtains specified information about the security of a file or directory\" [Source: 935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin]\n Observed import api \"GetSecurityDescriptorOwner\" which can \"Retrieves the owner information from a security descriptor\" [Source: 935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin]\n Observed import api \"RevertToSelf\" which can \"Terminates the impersonation of a client application\" [Source: 935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin]",
        "origin": "Static Parser",
        "attck_id": "T1134.001",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1134/001"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "System Security",
        "identifier": "string-474",
        "type": 2,
        "relevance": 1,
        "name": "Contains ability to access device drivers",
        "description": "Found string \"\\Device\\HarddiskVolume2\\cmd.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00004716.00000000.77972.69D30000.00000004.mdmp, 00000000-00004716.00000001.79890.69D30000.00000004.mdmp, 00000000-00004716.00000002.81813.69D30000.00000004.mdmp\")",
        "origin": "File/Memory",
        "attck_id": "T1543.003",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1543/003"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "External Systems",
        "identifier": "avtest-1",
        "type": 12,
        "relevance": 10,
        "name": "Sample was identified as clean by Antivirus engines",
        "description": "0/71 Antivirus vendors marked sample as malicious (0% detection rate)",
        "origin": "External System",
        "attck_id": null,
        "capec_id": null,
        "attck_id_wiki": null
      },
      {
        "threat_level": 1,
        "threat_level_human": "suspicious",
        "category": "General",
        "identifier": "static-92",
        "type": 0,
        "relevance": 5,
        "name": "PE file has unusual entropy resources",
        "description": "\"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\" has resource with unusual entropy  \"RT_ICON:7.85051980666\"",
        "origin": "Static Parser",
        "attck_id": "T1027.002",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1027/002"
      },
      {
        "threat_level": 1,
        "threat_level_human": "suspicious",
        "category": "Unusual Characteristics",
        "identifier": "hooks-8",
        "type": 11,
        "relevance": 10,
        "name": "Installs hooks/patches the running process",
        "description": "\"cmd.exe\" wrote bytes \"e0e8c4d7f97f0000\" to virtual address \"0x4932E000\" (part of module \"CMD.EXE\")\n \"cmd.exe\" wrote bytes \"a09d036a5b010000608e036a5b01000090b7016a5b010000a090036a5b010000508d016a5b010000502e016a5b01000020c4036a5b01000070bb036a5b01000080bc036a5b0100004078046a5b010000a0ba036a5b0100000088036a5b010000\" to virtual address \"0xE7D74030\" (part of module \"GDI32.DLL\")",
        "origin": "Hook Detection",
        "attck_id": "T1056.004",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1056/004"
      },
      {
        "threat_level": 1,
        "threat_level_human": "suspicious",
        "category": "Unusual Characteristics",
        "identifier": "static-1",
        "type": 0,
        "relevance": 1,
        "name": "Imports suspicious APIs",
        "description": "UnhandledExceptionFilter\n GetDriveTypeW\n GetFileAttributesW\n GetFileSize\n CreateDirectoryW\n DeleteFileW\n WriteFile\n FindNextFileW\n FindFirstFileW\n FindFirstFileExW\n GetFileAttributesExW\n CreateFileW\n DeviceIoControl\n CopyFileW\n GetProcAddress\n LoadLibraryExW\n GetModuleFileNameW\n GetModuleHandleW\n VirtualAlloc\n ReadProcessMemory\n GetCommandLineW\n TerminateProcess\n CreateProcessW\n GetStartupInfoW\n CreateProcessAsUserW\n RegCreateKeyExW\n RegDeleteValueW\n RegCloseKey\n RegEnumKeyExW\n RegOpenKeyExW\n RegDeleteKeyExW\n Sleep\n GetTickCount\n NtQueryInformationToken\n NtQueryInformationProcess",
        "origin": "Static Parser",
        "attck_id": "T1106",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1106"
      },
      {
        "threat_level": 1,
        "threat_level_human": "suspicious",
        "category": "Anti-Reverse Engineering",
        "identifier": "static-6",
        "type": 0,
        "relevance": 3,
        "name": "PE file has unusual entropy sections",
        "description": ".didat with unusual entropies 0.907093089296",
        "origin": "Static Parser",
        "attck_id": "T1027.002",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1027/002"
      },
      {
        "threat_level": 2,
        "threat_level_human": "malicious",
        "category": "Anti-Detection/Stealthyness",
        "identifier": "target-94",
        "type": 9,
        "relevance": 3,
        "name": "Found a system process name at an unusual pathway",
        "description": "Process \"cmd.exe\" has a system process name but is not located in a Windows (sub-)directory (UID: 00000000-00004716)",
        "origin": "Monitored Target",
        "attck_id": "T1036.005",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/techniques/T1036/005"
      }
    ]
  },
  {
    "classification_tags": [],
    "tags": [],
    "submissions": [
      {
        "submission_id": "60f5dadb3ddbd71a493b4e50",
        "filename": "file",
        "url": null,
        "created_at": "2021-07-19T20:04:43+00:00"
      },
      {
        "submission_id": "60e87e8ed717cf14e5771f4f",
        "filename": "file",
        "url": null,
        "created_at": "2021-07-09T16:51:26+00:00"
      },
      {
        "submission_id": "5f196598c665454d4960c94d",
        "filename": "file",
        "url": null,
        "created_at": "2020-07-23T10:25:28+00:00"
      }
    ],
    "machine_learning_models": [],
    "crowdstrike_ai": {
      "executable_process_memory_analysis": [],
      "analysis_related_urls": []
    },
    "job_id": null,
    "environment_id": null,
    "environment_description": "Static Analysis",
    "size": 232960,
    "type": "PE32+ executable (console) x86-64, for MS Windows",
    "type_short": [
      "peexe",
      "64bits",
      "executable"
    ],
    "target_url": null,
    "state": "SUCCESS",
    "error_type": null,
    "error_origin": null,
    "submit_name": "file",
    "md5": "f4f684066175b77e0c3a000549d2922c",
    "sha1": "99ae9c73e9bee6f9c76d6f4093a9882df06832cf",
    "sha256": "935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2",
    "sha512": "fe8f0593cc335ad28eb90211bc4ff01a3d2992cffb3877d04cefede9ef94afeb1a7d7874dd0c0ae04eaf8308291d5a4d879e6ecf6fe2b8d0ff1c3ac7ef143206",
    "ssdeep": null,
    "imphash": null,
    "entrypoint": null,
    "entrypoint_section": null,
    "image_base": null,
    "subsystem": null,
    "image_file_characteristics": [],
    "dll_characteristics": [],
    "major_os_version": null,
    "minor_os_version": null,
    "av_detect": 0,
    "vx_family": null,
    "url_analysis": false,
    "analysis_start_time": "2020-07-23T10:25:28+00:00",
    "threat_score": null,
    "interesting": false,
    "threat_level": 0,
    "verdict": "no specific threat",
    "certificates": [],
    "is_certificates_valid": null,
    "certificates_validation_message": null,
    "domains": [],
    "compromised_hosts": [],
    "hosts": [],
    "total_network_connections": 0,
    "total_processes": 0,
    "total_signatures": 0,
    "extracted_files": [],
    "file_metadata": null,
    "processes": [],
    "mitre_attcks": [],
    "network_mode": "default",
    "signatures": []
  },
  {
    "classification_tags": [],
    "tags": [],
    "submissions": [
      {
        "submission_id": "60195513efa3090ef70210f9",
        "filename": "utilman.exe",
        "url": null,
        "created_at": "2021-02-02T13:35:15+00:00"
      },
      {
        "submission_id": "5fd594e5fbef250536222759",
        "filename": "cmd.exe",
        "url": null,
        "created_at": "2020-12-13T04:13:25+00:00"
      },
      {
        "submission_id": "5f75727102a5f179cd29069e",
        "filename": "cmd.exe",
        "url": null,
        "created_at": "2020-10-01T06:08:49+00:00"
      },
      {
        "submission_id": "5ec0ceb2d7ce6a2712303213",
        "filename": "Utilman.exe",
        "url": null,
        "created_at": "2020-05-17T05:42:10+00:00"
      },
      {
        "submission_id": "5e53273fb30de355842896a2",
        "filename": "cmd.exe",
        "url": null,
        "created_at": "2020-02-24T01:30:39+00:00"
      },
      {
        "submission_id": "5d288eb0038838a74cfa9906",
        "filename": "cmd.exe",
        "url": null,
        "created_at": "2019-07-12T13:44:16+00:00"
      },
      {
        "submission_id": "5d2500bd0288388e538437b1",
        "filename": "cmd.exe",
        "url": null,
        "created_at": "2019-07-09T21:01:49+00:00"
      },
      {
        "submission_id": "5cbea1b4038838399c0365ff",
        "filename": "cmd.exe",
        "url": null,
        "created_at": "2019-04-23T05:25:08+00:00"
      },
      {
        "submission_id": "5c35e7b37ca3e11e9f79e9a4",
        "filename": "sethc.exe",
        "url": null,
        "created_at": "2019-01-09T06:23:15-06:00"
      },
      {
        "submission_id": "5c35cef37ca3e1571e6b9436",
        "filename": "sethc.exe",
        "url": null,
        "created_at": "2019-01-09T04:37:39-06:00"
      },
      {
        "submission_id": "5c35cdce7ca3e1550a1e6a92",
        "filename": "sethc.exe",
        "url": null,
        "created_at": "2019-01-09T04:32:46-06:00"
      },
      {
        "submission_id": "5b577fba7ca3e13656490373",
        "filename": "cmd.exe",
        "url": null,
        "created_at": "2018-07-24T14:36:26-05:00"
      },
      {
        "submission_id": "5b5601b37ca3e171691d73e2",
        "filename": "cmd.exe",
        "url": null,
        "created_at": "2018-07-23T11:26:27-05:00"
      },
      {
        "submission_id": "5b0e04857ca3e14c8f62c6fb",
        "filename": "cmd.exe",
        "url": null,
        "created_at": "2018-05-29T20:55:17-05:00"
      },
      {
        "submission_id": "5ad854a47ca3e1453f07bc82",
        "filename": "cmd.exe",
        "url": null,
        "created_at": "2018-04-19T03:34:44-05:00"
      },
      {
        "submission_id": "5ab269537ca3e101fb04a953",
        "filename": "cmd.exe",
        "url": null,
        "created_at": "2018-03-21T09:16:51-05:00"
      },
      {
        "submission_id": "5ab0cffe7ca3e12af23357d3",
        "filename": "cmd.exe",
        "url": null,
        "created_at": "2018-03-20T04:10:22-05:00"
      },
      {
        "submission_id": "5a94e29e7ca3e122510713e2",
        "filename": "cmd.exe",
        "url": null,
        "created_at": "2018-02-26T22:46:22-06:00"
      },
      {
        "submission_id": "5a26f15e7ca3e1169435c782",
        "filename": "cmd.exe",
        "url": null,
        "created_at": "2017-12-05T13:19:58-06:00"
      },
      {
        "submission_id": "5a26f0c47ca3e1158b6ee0e2",
        "filename": "cmd.exe",
        "url": null,
        "created_at": "2017-12-05T13:17:24-06:00"
      }
    ],
    "machine_learning_models": [],
    "crowdstrike_ai": {
      "executable_process_memory_analysis": [],
      "analysis_related_urls": []
    },
    "job_id": "58593319aac2edc56d351531",
    "environment_id": 100,
    "environment_description": "Windows 7 32 bit",
    "size": 232960,
    "type": "PE32+ executable (console) x86-64, for MS Windows",
    "type_short": [
      "peexe",
      "64bits",
      "executable"
    ],
    "target_url": null,
    "state": "SUCCESS",
    "error_type": null,
    "error_origin": null,
    "submit_name": "cmd.exe",
    "md5": "f4f684066175b77e0c3a000549d2922c",
    "sha1": "99ae9c73e9bee6f9c76d6f4093a9882df06832cf",
    "sha256": "935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2",
    "sha512": "fe8f0593cc335ad28eb90211bc4ff01a3d2992cffb3877d04cefede9ef94afeb1a7d7874dd0c0ae04eaf8308291d5a4d879e6ecf6fe2b8d0ff1c3ac7ef143206",
    "ssdeep": "3072:bkd4COZG6/A1tO1Y6TbkX2FtynroeJ/MEJoSsasbLLkhyjyGe:bkuC9+Af0Y6TbbFtkoeJk1KsfLXm",
    "imphash": "3062ed732d4b25d1c64f084dac97d37a",
    "entrypoint": "0x140015190",
    "entrypoint_section": ".text",
    "image_base": null,
    "subsystem": null,
    "image_file_characteristics": [],
    "dll_characteristics": [],
    "major_os_version": null,
    "minor_os_version": null,
    "av_detect": 0,
    "vx_family": null,
    "url_analysis": false,
    "analysis_start_time": "2020-02-24T01:30:48+00:00",
    "threat_score": 30,
    "interesting": false,
    "threat_level": 3,
    "verdict": "no verdict",
    "certificates": [],
    "is_certificates_valid": null,
    "certificates_validation_message": null,
    "domains": [],
    "compromised_hosts": [],
    "hosts": [],
    "total_network_connections": 0,
    "total_processes": 1,
    "total_signatures": 14,
    "extracted_files": [],
    "file_metadata": null,
    "processes": [],
    "mitre_attcks": [
      {
        "tactic": "Discovery",
        "technique": "System Time Discovery",
        "attck_id": "T1124",
        "attck_id_wiki": "https://attack.mitre.org/wiki/Technique/T1124",
        "malicious_identifiers_count": 0,
        "malicious_identifiers": [],
        "suspicious_identifiers_count": 0,
        "suspicious_identifiers": [],
        "informative_identifiers_count": 1,
        "informative_identifiers": [],
        "parent": null
      },
      {
        "tactic": "Discovery",
        "technique": "File and Directory Discovery",
        "attck_id": "T1083",
        "attck_id_wiki": "https://attack.mitre.org/wiki/Technique/T1083",
        "malicious_identifiers_count": 0,
        "malicious_identifiers": [],
        "suspicious_identifiers_count": 0,
        "suspicious_identifiers": [],
        "informative_identifiers_count": 1,
        "informative_identifiers": [],
        "parent": null
      }
    ],
    "network_mode": "default",
    "signatures": [
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "General",
        "identifier": "string-7",
        "type": 2,
        "relevance": 1,
        "name": "Contains PDB pathways",
        "description": "\"cmd.pdb\"",
        "origin": "File/Memory",
        "attck_id": null,
        "capec_id": null,
        "attck_id_wiki": null
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "Anti-Reverse Engineering",
        "identifier": "stream-4",
        "type": 1,
        "relevance": 1,
        "name": "Contains ability to register a top-level exception handler (often used as anti-debugging trick)",
        "description": "SetUnhandledExceptionFilter@api-ms-win-core-errorhandling-l1-1-1.dll at 43727-268-00000001400151E4",
        "origin": "Hybrid Analysis Technology",
        "attck_id": null,
        "capec_id": null,
        "attck_id_wiki": null
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "Environment Awareness",
        "identifier": "stream-49",
        "type": 1,
        "relevance": 1,
        "name": "Contains ability to query the system locale",
        "description": "GetUserDefaultLCID@api-ms-win-core-localization-l1-2-1.dll at 43727-287-00000001400069BC",
        "origin": "Hybrid Analysis Technology",
        "attck_id": null,
        "capec_id": null,
        "attck_id_wiki": null
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "Environment Awareness",
        "identifier": "stream-2",
        "type": 1,
        "relevance": 1,
        "name": "Contains ability to query machine time",
        "description": "GetSystemTime@api-ms-win-core-sysinfo-l1-2-1.dll at 43727-284-0000000140002BA0\n GetSystemTime@api-ms-win-core-sysinfo-l1-2-1.dll at 43727-285-000000014001F53C\n GetSystemTime@api-ms-win-core-sysinfo-l1-2-1.dll at 43727-296-00000001400020C8\n GetLocalTime@api-ms-win-core-sysinfo-l1-2-1.dll at 43727-993-000000014001F6C3\n GetSystemTimeAsFileTime@api-ms-win-core-sysinfo-l1-2-1.dll at 43727-599-00000001400156B4",
        "origin": "Hybrid Analysis Technology",
        "attck_id": "T1124",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/wiki/Technique/T1124"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "Environment Awareness",
        "identifier": "stream-3",
        "type": 1,
        "relevance": 1,
        "name": "Contains ability to query the machine version",
        "description": "GetVersion@api-ms-win-core-sysinfo-l1-2-1.dll at 43727-439-0000000140001008",
        "origin": "Hybrid Analysis Technology",
        "attck_id": null,
        "capec_id": null,
        "attck_id_wiki": null
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "Environment Awareness",
        "identifier": "stream-37",
        "type": 1,
        "relevance": 3,
        "name": "Contains ability to query volume size",
        "description": "GetDiskFreeSpaceExW@api-ms-win-core-file-l1-2-1.dll at 43727-485-000000014002542C",
        "origin": "Hybrid Analysis Technology",
        "attck_id": "T1083",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/wiki/Technique/T1083"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "Environment Awareness",
        "identifier": "stream-31",
        "type": 1,
        "relevance": 1,
        "name": "Possibly tries to detect the presence of a debugger",
        "description": "GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 43727-314-000000014000BC30\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 43727-316-0000000140008FA0\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 43727-270-000000014000B4A0\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 43727-271-000000014000B530\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 43727-277-0000000140011840\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 43727-297-000000014000E278\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 43727-298-000000014000E2EC\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 43727-305-0000000140005C6C\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 43727-661-00000001400016F0\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 43727-331-0000000140014D2C\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 43727-355-0000000140005954\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 43727-366-00000001400032FC\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 43727-383-000000014000D360\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 43727-441-000000014000D110\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 43727-511-000000014000B170\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 43727-523-000000014000BCE0\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 43727-588-0000000140006418\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 43727-596-000000014001168C\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 43727-605-0000000140014190\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 43727-607-0000000140014044",
        "origin": "Hybrid Analysis Technology",
        "attck_id": null,
        "capec_id": null,
        "attck_id_wiki": null
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "Network Related",
        "identifier": "string-3",
        "type": 2,
        "relevance": 10,
        "name": "Found potential URL in binary/memory",
        "description": "Pattern match: \"http://schemas.microsoft.com/SMI/2005/WindowsSettings\"",
        "origin": "File/Memory",
        "attck_id": null,
        "capec_id": null,
        "attck_id_wiki": null
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "External Systems",
        "identifier": "avtest-1",
        "type": 12,
        "relevance": 10,
        "name": "Sample was identified as clean by Antivirus engines",
        "description": "0/68 Antivirus vendors marked sample as malicious (0% detection rate)\n 0/22 Antivirus vendors marked sample as malicious (0% detection rate)",
        "origin": "External System",
        "attck_id": null,
        "capec_id": null,
        "attck_id_wiki": null
      },
      {
        "threat_level": 1,
        "threat_level_human": "suspicious",
        "category": "Unusual Characteristics",
        "identifier": "static-60",
        "type": 0,
        "relevance": 10,
        "name": "PE file contains unusual section name",
        "description": "\"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\" has a section named \".didat\"",
        "origin": "Static Parser",
        "attck_id": null,
        "capec_id": null,
        "attck_id_wiki": null
      },
      {
        "threat_level": 1,
        "threat_level_human": "suspicious",
        "category": "Unusual Characteristics",
        "identifier": "static-1",
        "type": 0,
        "relevance": 1,
        "name": "Imports suspicious APIs",
        "description": "UnhandledExceptionFilter\n GetDriveTypeW\n GetFileAttributesW\n GetFileSize\n CreateDirectoryW\n DeleteFileW\n WriteFile\n FindNextFileW\n FindFirstFileW\n FindFirstFileExW\n GetFileAttributesExW\n CreateFileW\n DeviceIoControl\n CopyFileW\n GetProcAddress\n LoadLibraryExW\n GetModuleFileNameW\n GetModuleHandleW\n VirtualAlloc\n ReadProcessMemory\n GetCommandLineW\n TerminateProcess\n CreateProcessW\n GetStartupInfoW\n CreateProcessAsUserW\n RegCreateKeyExW\n RegDeleteValueW\n RegCloseKey\n RegEnumKeyExW\n RegOpenKeyExW\n RegDeleteKeyExW\n Sleep\n GetTickCount\n NtQueryInformationToken\n NtQueryInformationProcess",
        "origin": "Static Parser",
        "attck_id": null,
        "capec_id": null,
        "attck_id_wiki": null
      },
      {
        "threat_level": 1,
        "threat_level_human": "suspicious",
        "category": "Anti-Detection/Stealthyness",
        "identifier": "stream-42",
        "type": 1,
        "relevance": 3,
        "name": "Possibly tries to hide a process launching it with different user credentials",
        "description": "CreateProcessAsUserW@api-ms-win-core-processthreads-l1-1-2.dll at 43727-828-000000014000EFFE",
        "origin": "Hybrid Analysis Technology",
        "attck_id": null,
        "capec_id": null,
        "attck_id_wiki": null
      },
      {
        "threat_level": 2,
        "threat_level_human": "malicious",
        "category": "General",
        "identifier": "stream-21",
        "type": 1,
        "relevance": 8,
        "name": "Contains ability to start/interact with device drivers",
        "description": "DeviceIoControl@api-ms-win-core-io-l1-1-1.dll at 43727-611-0000000140013690",
        "origin": "Hybrid Analysis Technology",
        "attck_id": null,
        "capec_id": null,
        "attck_id_wiki": null
      },
      {
        "threat_level": 2,
        "threat_level_human": "malicious",
        "category": "Unusual Characteristics",
        "identifier": "stream-22",
        "type": 1,
        "relevance": 5,
        "name": "Contains native function calls",
        "description": "NtFsControlFile@ntdll.dll at 43727-309-00000001400268C4\n NtCancelSynchronousIoFile@ntdll.dll at 43727-532-00000001400227A0\n NtOpenThreadToken@ntdll.dll at 43727-585-00000001400029C0\n NtQueryInformationToken@ntdll.dll at 43727-586-0000000140002A84\n NtQueryInformationToken@ntdll.dll at 43727-587-0000000140002AD4\n NtQueryInformationProcess@ntdll.dll at 43727-630-0000000140004480\n NtOpenFile@ntdll.dll at 43727-643-00000001400042DC\n NtQueryVolumeInformationFile@ntdll.dll at 43727-644-00000001400043D8",
        "origin": "Hybrid Analysis Technology",
        "attck_id": null,
        "capec_id": null,
        "attck_id_wiki": null
      }
    ]
  },
  {
    "classification_tags": [],
    "tags": [],
    "submissions": [
      {
        "submission_id": "5f85aeb7dbdeb607bb5e34eb",
        "filename": "kiss.exe",
        "url": null,
        "created_at": "2020-10-13T13:42:15+00:00"
      },
      {
        "submission_id": "5d8b4dbf028838d6417f6d53",
        "filename": "cmd.exe",
        "url": null,
        "created_at": "2019-09-25T11:21:35+00:00"
      },
      {
        "submission_id": "5d8b4db702883891837f6b95",
        "filename": "cmd.exe",
        "url": null,
        "created_at": "2019-09-25T11:21:27+00:00"
      },
      {
        "submission_id": "5d4846eb0288385a279299b7",
        "filename": "cmd.exe",
        "url": null,
        "created_at": "2019-08-05T15:10:35+00:00"
      },
      {
        "submission_id": "5d250066038838da118437b2",
        "filename": "cmd.exe",
        "url": null,
        "created_at": "2019-07-09T21:00:22+00:00"
      },
      {
        "submission_id": "5ce828c5038838ca61130390",
        "filename": "cmd.exe",
        "url": null,
        "created_at": "2019-05-24T17:24:21+00:00"
      },
      {
        "submission_id": "5cb263840388384184827cf6",
        "filename": "sethc.exe",
        "url": null,
        "created_at": "2019-04-13T22:32:36+00:00"
      },
      {
        "submission_id": "5b69b6167ca3e129e233b695",
        "filename": "cmd.exe",
        "url": null,
        "created_at": "2018-08-07T10:09:10-05:00"
      },
      {
        "submission_id": "5b576e3e7ca3e1632e094913",
        "filename": "cmd.exe",
        "url": null,
        "created_at": "2018-07-24T13:21:50-05:00"
      },
      {
        "submission_id": "5b576ce57ca3e15a46380635",
        "filename": "cmd.exe",
        "url": null,
        "created_at": "2018-07-24T13:16:05-05:00"
      },
      {
        "submission_id": "5ab0d1057ca3e12dbd5d09f2",
        "filename": "cmd.exe",
        "url": null,
        "created_at": "2018-03-20T04:14:45-05:00"
      },
      {
        "submission_id": "5a7c75817ca3e13c9b2ebf52",
        "filename": "cmd.exe",
        "url": null,
        "created_at": "2018-02-08T10:06:25-06:00"
      },
      {
        "submission_id": "5a34f2a27ca3e13531789a94",
        "filename": "cmd.exe",
        "url": null,
        "created_at": "2017-12-16T04:17:06-06:00"
      }
    ],
    "machine_learning_models": [],
    "crowdstrike_ai": {
      "executable_process_memory_analysis": [],
      "analysis_related_urls": []
    },
    "job_id": "5a34f2a27ca3e13531789a95",
    "environment_id": 120,
    "environment_description": "Windows 7 64 bit",
    "size": 232960,
    "type": "PE32+ executable (console) x86-64, for MS Windows",
    "type_short": [
      "peexe",
      "64bits",
      "executable"
    ],
    "target_url": null,
    "state": "SUCCESS",
    "error_type": null,
    "error_origin": null,
    "submit_name": "cmd.exe",
    "md5": "f4f684066175b77e0c3a000549d2922c",
    "sha1": "99ae9c73e9bee6f9c76d6f4093a9882df06832cf",
    "sha256": "935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2",
    "sha512": "fe8f0593cc335ad28eb90211bc4ff01a3d2992cffb3877d04cefede9ef94afeb1a7d7874dd0c0ae04eaf8308291d5a4d879e6ecf6fe2b8d0ff1c3ac7ef143206",
    "ssdeep": "3072:bkd4COZG6/A1tO1Y6TbkX2FtynroeJ/MEJoSsasbLLkhyjyGe:bkuC9+Af0Y6TbbFtkoeJk1KsfLXm",
    "imphash": "3062ed732d4b25d1c64f084dac97d37a",
    "entrypoint": "0x140015190",
    "entrypoint_section": ".text",
    "image_base": null,
    "subsystem": null,
    "image_file_characteristics": [],
    "dll_characteristics": [],
    "major_os_version": null,
    "minor_os_version": null,
    "av_detect": 0,
    "vx_family": null,
    "url_analysis": false,
    "analysis_start_time": "2019-09-25T11:21:32+00:00",
    "threat_score": 30,
    "interesting": false,
    "threat_level": 3,
    "verdict": "no verdict",
    "certificates": [],
    "is_certificates_valid": null,
    "certificates_validation_message": null,
    "domains": [],
    "compromised_hosts": [],
    "hosts": [],
    "total_network_connections": 0,
    "total_processes": 1,
    "total_signatures": 14,
    "extracted_files": [],
    "file_metadata": null,
    "processes": [],
    "mitre_attcks": [
      {
        "tactic": "Discovery",
        "technique": "File and Directory Discovery",
        "attck_id": "T1083",
        "attck_id_wiki": "https://attack.mitre.org/wiki/Technique/T1083",
        "malicious_identifiers_count": 0,
        "malicious_identifiers": [],
        "suspicious_identifiers_count": 0,
        "suspicious_identifiers": [],
        "informative_identifiers_count": 1,
        "informative_identifiers": [],
        "parent": null
      },
      {
        "tactic": "Discovery",
        "technique": "System Time Discovery",
        "attck_id": "T1124",
        "attck_id_wiki": "https://attack.mitre.org/wiki/Technique/T1124",
        "malicious_identifiers_count": 0,
        "malicious_identifiers": [],
        "suspicious_identifiers_count": 0,
        "suspicious_identifiers": [],
        "informative_identifiers_count": 1,
        "informative_identifiers": [],
        "parent": null
      }
    ],
    "network_mode": "default",
    "signatures": [
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "General",
        "identifier": "string-7",
        "type": 2,
        "relevance": 1,
        "name": "Contains PDB pathways",
        "description": "\"cmd.pdb\"",
        "origin": "File/Memory",
        "attck_id": null,
        "capec_id": null,
        "attck_id_wiki": null
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "Anti-Reverse Engineering",
        "identifier": "stream-4",
        "type": 1,
        "relevance": 1,
        "name": "Contains ability to register a top-level exception handler (often used as anti-debugging trick)",
        "description": "SetUnhandledExceptionFilter@api-ms-win-core-errorhandling-l1-1-1.dll at 12264-268-00000001400151E4",
        "origin": "Hybrid Analysis Technology",
        "attck_id": null,
        "capec_id": null,
        "attck_id_wiki": null
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "Environment Awareness",
        "identifier": "stream-31",
        "type": 1,
        "relevance": 1,
        "name": "Possibly tries to detect the presence of a debugger",
        "description": "GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 12264-314-000000014000BC30\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 12264-316-0000000140008FA0\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 12264-270-000000014000B4A0\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 12264-271-000000014000B530\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 12264-277-0000000140011840\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 12264-331-0000000140014D2C\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 12264-297-000000014000E278\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 12264-298-000000014000E2EC\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 12264-305-0000000140005C6C\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 12264-383-000000014000D360\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 12264-355-0000000140005954\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 12264-366-00000001400032FC\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 12264-441-000000014000D110\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 12264-511-000000014000B170\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 12264-523-000000014000BCE0\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 12264-588-0000000140006418\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 12264-596-000000014001168C\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 12264-605-0000000140014190\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 12264-623-00000001400123F0\n GetProcessHeap@api-ms-win-core-heap-l1-2-0.dll at 12264-607-0000000140014044",
        "origin": "Hybrid Analysis Technology",
        "attck_id": null,
        "capec_id": null,
        "attck_id_wiki": null
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "Environment Awareness",
        "identifier": "stream-37",
        "type": 1,
        "relevance": 3,
        "name": "Contains ability to query volume size",
        "description": "GetDiskFreeSpaceExW@api-ms-win-core-file-l1-2-1.dll at 12264-485-000000014002542C",
        "origin": "Hybrid Analysis Technology",
        "attck_id": "T1083",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/wiki/Technique/T1083"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "Environment Awareness",
        "identifier": "stream-2",
        "type": 1,
        "relevance": 1,
        "name": "Contains ability to query machine time",
        "description": "GetSystemTime@api-ms-win-core-sysinfo-l1-2-1.dll at 12264-284-0000000140002BA0\n GetSystemTime@api-ms-win-core-sysinfo-l1-2-1.dll at 12264-285-000000014001F53C\n GetSystemTime@api-ms-win-core-sysinfo-l1-2-1.dll at 12264-296-00000001400020C8\n GetSystemTimeAsFileTime@api-ms-win-core-sysinfo-l1-2-1.dll at 12264-599-00000001400156B4\n GetLocalTime@api-ms-win-core-sysinfo-l1-2-1.dll at 12264-993-000000014001F6C3",
        "origin": "Hybrid Analysis Technology",
        "attck_id": "T1124",
        "capec_id": null,
        "attck_id_wiki": "https://attack.mitre.org/wiki/Technique/T1124"
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "Environment Awareness",
        "identifier": "stream-3",
        "type": 1,
        "relevance": 1,
        "name": "Contains ability to query the machine version",
        "description": "GetVersion@api-ms-win-core-sysinfo-l1-2-1.dll at 12264-439-0000000140001008",
        "origin": "Hybrid Analysis Technology",
        "attck_id": null,
        "capec_id": null,
        "attck_id_wiki": null
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "Environment Awareness",
        "identifier": "stream-49",
        "type": 1,
        "relevance": 1,
        "name": "Contains ability to query the system locale",
        "description": "GetUserDefaultLCID@api-ms-win-core-localization-l1-2-1.dll at 12264-287-00000001400069BC",
        "origin": "Hybrid Analysis Technology",
        "attck_id": null,
        "capec_id": null,
        "attck_id_wiki": null
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "Network Related",
        "identifier": "string-3",
        "type": 2,
        "relevance": 10,
        "name": "Found potential URL in binary/memory",
        "description": "Pattern match: \"http://schemas.microsoft.com/SMI/2005/WindowsSettings\"",
        "origin": "File/Memory",
        "attck_id": null,
        "capec_id": null,
        "attck_id_wiki": null
      },
      {
        "threat_level": 0,
        "threat_level_human": "informative",
        "category": "External Systems",
        "identifier": "avtest-1",
        "type": 12,
        "relevance": 10,
        "name": "Sample was identified as clean by Antivirus engines",
        "description": "0/16 Antivirus vendors marked sample as malicious (0% detection rate)\n 0/70 Antivirus vendors marked sample as malicious (0% detection rate)",
        "origin": "External System",
        "attck_id": null,
        "capec_id": null,
        "attck_id_wiki": null
      },
      {
        "threat_level": 1,
        "threat_level_human": "suspicious",
        "category": "Unusual Characteristics",
        "identifier": "static-60",
        "type": 0,
        "relevance": 10,
        "name": "PE file contains unusual section name",
        "description": "\"935c1861df1f4018d698e8b65abfa02d7e9037d8f68ca3c2065b6ca165d44ad2.bin\" has a section named \".didat\"",
        "origin": "Static Parser",
        "attck_id": null,
        "capec_id": null,
        "attck_id_wiki": null
      },
      {
        "threat_level": 1,
        "threat_level_human": "suspicious",
        "category": "Unusual Characteristics",
        "identifier": "static-1",
        "type": 0,
        "relevance": 1,
        "name": "Imports suspicious APIs",
        "description": "UnhandledExceptionFilter\n GetDriveTypeW\n GetFileAttributesW\n GetFileSize\n CreateDirectoryW\n DeleteFileW\n WriteFile\n FindNextFileW\n FindFirstFileW\n FindFirstFileExW\n GetFileAttributesExW\n CreateFileW\n DeviceIoControl\n CopyFileW\n GetProcAddress\n LoadLibraryExW\n GetModuleFileNameW\n GetModuleHandleW\n VirtualAlloc\n ReadProcessMemory\n GetCommandLineW\n TerminateProcess\n CreateProcessW\n GetStartupInfoW\n CreateProcessAsUserW\n RegCreateKeyExW\n RegDeleteValueW\n RegCloseKey\n RegEnumKeyExW\n RegOpenKeyExW\n RegDeleteKeyExW\n Sleep\n GetTickCount\n NtQueryInformationToken\n NtQueryInformationProcess",
        "origin": "Static Parser",
        "attck_id": null,
        "capec_id": null,
        "attck_id_wiki": null
      },
      {
        "threat_level": 1,
        "threat_level_human": "suspicious",
        "category": "Anti-Detection/Stealthyness",
        "identifier": "stream-42",
        "type": 1,
        "relevance": 3,
        "name": "Possibly tries to hide a process launching it with different user credentials",
        "description": "CreateProcessAsUserW@api-ms-win-core-processthreads-l1-1-2.dll at 12264-828-000000014000EFFE",
        "origin": "Hybrid Analysis Technology",
        "attck_id": null,
        "capec_id": null,
        "attck_id_wiki": null
      },
      {
        "threat_level": 2,
        "threat_level_human": "malicious",
        "category": "General",
        "identifier": "stream-21",
        "type": 1,
        "relevance": 8,
        "name": "Contains ability to start/interact with device drivers",
        "description": "DeviceIoControl@api-ms-win-core-io-l1-1-1.dll at 12264-611-0000000140013690",
        "origin": "Hybrid Analysis Technology",
        "attck_id": null,
        "capec_id": null,
        "attck_id_wiki": null
      },
      {
        "threat_level": 2,
        "threat_level_human": "malicious",
        "category": "Unusual Characteristics",
        "identifier": "stream-22",
        "type": 1,
        "relevance": 5,
        "name": "Contains native function calls",
        "description": "NtFsControlFile@ntdll.dll at 12264-309-00000001400268C4\n NtCancelSynchronousIoFile@ntdll.dll at 12264-532-00000001400227A0\n NtOpenProcessToken@ntdll.dll at 12264-585-00000001400029C0\n NtQueryInformationToken@ntdll.dll at 12264-586-0000000140002A84\n NtQueryInformationToken@ntdll.dll at 12264-587-0000000140002AD4\n NtSetInformationProcess@ntdll.dll at 12264-630-0000000140004480\n NtOpenFile@ntdll.dll at 12264-643-00000001400042DC\n NtQueryVolumeInformationFile@ntdll.dll at 12264-644-00000001400043D8",
        "origin": "Hybrid Analysis Technology",
        "attck_id": null,
        "capec_id": null,
        "attck_id_wiki": null
      }
    ]
  }
]
    Was this article helpful?
    What's Next