24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 3c:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T40e,{"@context":"https://schema.org","@type":"TechArticle","headline":"Clean Sample 05732e84de58… — Score 0/100 — Hybrid Analysis","description":"Clean verdict for sample 05732e84de58…. Threat score 0/100. 0/24 AV engines flagged this file. 2 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/05732e84de58a3cc142535431b3aa04efbe034cc96e837f93c360a6387d8faad","keywords":["Clean","malware analysis","sandbox report","threat intelligence","05732e84de58a3cc142535431b3aa04efbe034cc96e837f93c360a6387d8faad"],"about":{"@type":"SoftwareApplication","name":"mysqlsqa.exe","applicationCategory":["peexe","executable"],"identifier":"05732e84de58a3cc142535431b3aa04efbe034cc96e837f93c360a6387d8faad","additionalType":"Clean sample"},"threatScore":0,"antivirusDetections":{"malicious":0,"total":24},"behavioralIndicators":{"malicious":2,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T597,Pattern match: "www.microsoft.com/exporting" Pattern match: "crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0X" Pattern match: "http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl0Z" Pattern match: "http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T" Pattern match: "www.microsoft.com/pki/certs/MicrosoftRootCert.crt0" Pattern match: "http://www.sysinternals.com" Pattern match: "www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0" Pattern match: "www.microsoft.com/pkiops/docs/primarycps.htm0@" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z" Pattern match: "http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0" Pattern match: "www.microsoft.com/PKI/docs/CPS/default.htm0@" Pattern match: "crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z" Pattern match: "http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0" Pattern match: "www.microsoft.com" Pattern match: "www.sysinternals.com"26:T2114,"\pard\brdrb\brdrs\brdrw10\brsp20 \sb120\sa120\b\f0\fs24 SYSINTERNALS SOFTWARE LICENSE TERMS\fs28\par" (Indicator: "sysinternals") "\pard\sb120\sa120\b0\fs19 These license terms are an agreement between Sysinternals (a wholly owned subsidiary of Microsoft Corporation) and you. Please read them. They apply to the software you are downloading from Systinternals.com, which includes the media on which you received it, if any. The terms also apply to any Sysinternals\par" (Indicator: "sysinternals") "\caps\fs20 2.\tab\fs19 Scope of License\caps0 .\b0 The software is licensed, not sold. This agreement only gives you some rights to use the software. Sysinternals reserves all other rights. Unless applicable law gives you more rights despite this limitation, you may use the software only as expressly permitted in this agreement. In doing so, you must comply with any technical limitations in the software that only allow you to use it in certain ways. You may not\b\par" (Indicator: "sysinternals") "\pard\fi-357\li357\sb120\sa120\tx360\b\fs20 3.\tab SENSITIVE INFORMATION. \b0 Please be aware that, similar to other debug tools that capture \ldblquote process state\rdblquote information, files saved by Sysinternals tools may include personally identifiable or other sensitive information (such as usernames, passwords, paths to files accessed, and paths to registry accessed). By using this software, you acknowledge that you are aware of this and take sole responsibility for any personally identifiable or other sensitive information provided to Microsoft or any other party through your use of the software.\b\par" (Indicator: "sysinternals") "\fs20 11.\tab\fs19 Disclaimer of Warranty.\caps0 \caps The software is licensed "as - is." You bear the risk of using it. SYSINTERNALS gives no express warranties, guarantees or conditions. You may have additional consumer rights under your local laws which this agreement cannot change. To the extent permitted under your local laws, SYSINTERNALS excludes the implied warranties of merchantability, fitness for a particular purpose and non-infringement.\par" (Indicator: "sysinternals") "\pard\fi-360\li360\sb120\sa120\tx360\fs20 12.\tab\fs19 Limitation on and Exclusion of Remedies and Damages. You can recover from SYSINTERNALS and its suppliers only direct damages up to U.S. $5.00. You cannot recover any other damages, including consequential, lost profits, special, indirect or incidental damages.\par" (Indicator: "sysinternals") "\pard\li360\sb120\sa120 It also applies even if Sysinternals knew or should have known about the possibility of the damages. The above limitation or exclusion may not apply to you because your country may not allow the exclusion or limitation of incidental, consequential or other damages.\par" (Indicator: "sysinternals") "\pard\sb120\sa120 EXON\'c9RATION DE GARANTIE.\b0 Le logiciel vis\'e9 par une licence est offert \'ab tel quel \'bb. Toute utilisation de ce logiciel est \'e0 votre seule risque et p\'e9ril. Sysinternals n'accorde aucune autre garantie expresse. Vous pouvez b\'e9n\'e9ficier de droits additionnels en vertu du droit local sur la protection dues consommateurs, que ce contrat ne peut modifier. La ou elles sont permises par le droit locale, les garanties implicites de qualit\'e9 marchande, d'ad\'e9quation \'e0 un usage particulier et d'absence de contrefa\'e7on sont exclues.\par" (Indicator: "sysinternals") "\pard\keepn\sb120\sa120\b LIMITATION DES DOMMAGES-INT\'c9R\'caTS ET EXCLUSION DE RESPONSABILIT\'c9 POUR LES DOMMAGES.\b0 Vous pouvez obtenir de Sysinternals et de ses fournisseurs une indemnisation en cas de dommages directs uniquement \'e0 hauteur de 5,00 $ US. Vous ne pouvez pr\'e9tendre \'e0 aucune indemnisation pour les autres dommages, y compris les dommages sp\'e9ciaux, indirects ou accessoires et pertes de b\'e9n\'e9fices.\par" (Indicator: "sysinternals") "\pard\sb120\sa120 Elle s'applique \'e9galement, m\'eame si Sysinternals connaissait ou devrait conna\'eetre l'\'e9ventualit\'e9 d'un tel dommage. Si votre pays n'autorise pas l'exclusion ou la limitation de responsabilit\'e9 pour les dommages indirects, accessoires ou de quelque nature que ce soit, il se peut que la limitation ou l'exclusion ci-dessus ne s'appliquera pas \'e0 votre \'e9gard.\par" (Indicator: "sysinternals") "http://www.sysinternals.com 0" (Indicator: "sysinternals") "SYSINTERNALS SOFTWARE LICENSE TERMS These license terms are an agreement between Sysinternals(a wholly owned subsidiary of Microsoft Corporation) and you.Please read them.They apply to the software you are downloading from technet.microsoft.com / sysinternals, which includes the media on which you received it, if any.The terms also apply to any Sysinternals * updates, *supplements, *Internet - based services, *and support services for this software, unless other terms accompany those items.If so, those terms apply. BY USING THE SOFTWARE, YOU ACCEPT THESE TERMS.IF YOU DO NOT ACCEPT THEM, DO NOT USE THE SOFTWARE. If you comply with these license terms, you have the rights below. INSTALLATION AND USER RIGHTS You may install and use any number of copies of the software on your devices. SCOPE OF LICENSE The software is licensed, not sold.This agreement only gives you some rights to use the software.Sysinternals reserves all other rights.Unless applicable law gives you more rights despite this limitation, you may" (Indicator: "sysinternals") "information, files saved by Sysinternals tools may include personally identifiable or other sensitive information(such as usernames, passwords, paths to files accessed, and paths to registry accessed).By using this software, you acknowledge that you are aware of this and take sole responsibility for any personally identifiable or other sensitive information provided to Microsoft or any other party through your use of the software. DOCUMENTATION Any person that has valid access to your computer or internal network may copy and use the documentation for your internal, reference purposes. EXPORT RESTRICTIONS The software is subject to United States export laws and regulations.You must comply with all domestic and international export laws and regulations that apply to the software.These laws include restrictions on destinations, end users and end use.For additional information, see www.microsoft.com / exporting . SUPPORT SERVICES Because this software is "as is " we may not provide support services for it." (Indicator: "sysinternals") "DISCLAIMER OF WARRANTY The software is licensed "as - is." You bear the risk of using it.Sysinternals gives no express warranties, guarantees or conditions.You may have additional consumer rights under your local laws which this agreement cannot change.To the extent permitted under your local laws, sysinternals excludes the implied warranties of merchantability, fitness for a particular purpose and non - infringement. LIMITATION ON AND EXCLUSION OF REMEDIES AND DAMAGES You can recover from sysinternals and its suppliers only direct damages up to U.S.$5.00.You cannot recover any other damages, including consequential, lost profits, special, indirect or incidental damages. This limitation applies to * anything related to the software, services, content(including code) on third party Internet sites, or third party programs; and * claims for breach of contract, breach of warranty, guarantee or condition, strict liability, negligence, or other tort to the extent permitted by applicable law. It also applies even" (Indicator: "sysinternals") "if Sysinternals knew or should have known about the possibility of the damages.The above limitation or exclusion may not apply to you because your country may not allow the exclusion or limitation of incidental, consequential or other damages. Please note : As this software is distributed in Quebec, Canada, some of the clauses in this agreement are provided below in French. Remarque : Ce logiciel" (Indicator: "sysinternals") "ril.Sysinternals n'accorde aucune autre garantie expresse. Vous pouvez b" (Indicator: "sysinternals") "POUR LES DOMMAGES.Vous pouvez obtenir de Sysinternals et de ses fournisseurs une indemnisation en cas de dommages directs uniquement" (Indicator: "sysinternals") "me si Sysinternals connaissait ou devrait conna" (Indicator: "sysinternals") "Sysinternals License" (Indicator: "sysinternals") "Software\Sysinternals\%s" (Indicator: "sysinternals")27:T4c8,Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "procdumpexe.exe") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "procdumpexe.exe") Found reference to API "ICorDebugManagedCallback::CreateThread" (Indicator: "CreateThread"; File: "procdumpexe.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "procdumpexe.exe") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API "ICorDebugManagedCallback::CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp")28:T490,Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; File: "procdumpexe.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "procdumpexe.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "procdumpexe.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "procdumpexe.exe") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp")29:T108d,Assembly shows XOR instruction xor eax ebp in Stream UID: 5186-3092-00408D60 Assembly shows XOR instruction xor ecx ebp in Stream UID: 5186-3092-00408D60 Assembly shows XOR instruction xor eax esp in Stream UID: 5186-3103-004061E0 Assembly shows XOR instruction xor ecx esp in Stream UID: 5186-3103-004061E0 Assembly shows XOR instruction xor ecx esp in Stream UID: 5186-3151-00401957 Assembly shows XOR instruction xor eax ebp in Stream UID: 5186-3115-00424832 Assembly shows XOR instruction xor ecx ebp in Stream UID: 5186-3115-00424832 Assembly shows XOR instruction xor eax ebp in Stream UID: 5186-3193-00401B30 Assembly shows XOR instruction xor ecx ebp in Stream UID: 5186-3193-00401B30 Assembly shows XOR instruction xor eax ebp in Stream UID: 5186-3268-0041B1D0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 5186-3268-0041B1D0 Assembly shows XOR instruction xor eax ebp in Stream UID: 5186-50-0041D800 Assembly shows XOR instruction xor ecx ebp in Stream UID: 5186-50-0041D800 Assembly shows XOR instruction xor eax esp in Stream UID: 5186-3220-00404EC0 Assembly shows XOR instruction xor ecx esp in Stream UID: 5186-3220-00404EC0 Assembly shows XOR instruction xor eax ebp in Stream UID: 5186-3297-004269AE Assembly shows XOR instruction xor ecx ebp in Stream UID: 5186-3297-004269AE Assembly shows XOR instruction xor eax ebp in Stream UID: 5186-3279-0041F09A Assembly shows XOR instruction xor ecx eax in Stream UID: 5186-3279-0041F09A Assembly shows XOR instruction xor ecx ebp in Stream UID: 5186-3279-0041F09A Assembly shows XOR instruction xor eax ebp in Stream UID: 5186-3076-0040B1A0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 5186-3076-0040B1A0 Assembly shows XOR instruction xor eax ebp in Stream UID: 5186-3072-0040B2D0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 5186-3072-0040B2D0 Assembly shows XOR instruction xor eax ebp in Stream UID: 5186-3064-004118B0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 5186-3064-004118B0 Assembly shows XOR instruction xor eax ebp in Stream UID: 5186-3260-00419043 Assembly shows XOR instruction xor ecx ebp in Stream UID: 5186-3260-00419043 Assembly shows XOR instruction xor eax dword ptr [ecx+08h] in Stream UID: 5186-3022-0041A40A Assembly shows XOR instruction xor dword ptr [ecx+08h] eax in Stream UID: 5186-3022-0041A40A Assembly shows XOR instruction xor ecx dword ptr [eax] in Stream UID: 5186-3022-0041A40A Assembly shows XOR instruction xor dword ptr [eax] ecx in Stream UID: 5186-3022-0041A40A Assembly shows XOR instruction xor eax ebp in Stream UID: 5186-3197-00404510 Assembly shows XOR instruction xor ecx ebp in Stream UID: 5186-3197-00404510 Assembly shows XOR instruction xor eax ebp in Stream UID: 5186-3081-0040A2B0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 5186-3081-0040A2B0 Assembly shows XOR instruction xor eax ebp in Stream UID: 5186-3294-00420455 Assembly shows XOR instruction xor ecx eax in Stream UID: 5186-3294-00420455 Assembly shows XOR instruction xor ecx ebp in Stream UID: 5186-3294-00420455 Assembly shows XOR instruction xor eax ebp in Stream UID: 5186-3082-0040A560 Assembly shows XOR instruction xor ecx ebp in Stream UID: 5186-3082-0040A560 Assembly shows XOR instruction xor eax ebp in Stream UID: 5186-3102-0040B6C0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 5186-3102-0040B6C0 Assembly shows XOR instruction xor eax ebp in Stream UID: 5186-3117-0040A4B0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 5186-3117-0040A4B0 Assembly shows XOR instruction xor eax esp in Stream UID: 5186-3099-00407620 Assembly shows XOR instruction xor ecx esp in Stream UID: 5186-3099-00407620 Assembly shows XOR instruction xor eax ebp in Stream UID: 5186-3101-00408B20 Assembly shows XOR instruction xor ecx ebp in Stream UID: 5186-3101-00408B20 Assembly shows XOR instruction xor eax ebp in Stream UID: 5186-3118-00407FB0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 5186-3118-00407FB0 Assembly shows XOR instruction xor eax ebp in Stream UID: 5186-3044-00413020 Assembly shows XOR instruction xor ecx ebp in Stream UID: 5186-3044-004130202a:T4f4,"procdumpexe.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005084) "procdumpexe.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005084)2b:T506,Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "procdumpexe.exe") Found reference to API "NtQuerySystemInformation" (Indicator: "QuerySystemInformation"; File: "procdumpexe.exe") Found reference to API "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStrings"; File: "procdumpexe.exe") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; File: "procdumpexe.exe") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "QuerySystemInformation"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp")2c:T780,Found reference to API "GetVersionFromProcess" (Indicator: "GetVersion"; File: "procdumpexe.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "procdumpexe.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "procdumpexe.exe") Found reference to API "ICLRRuntimeInfo->GetVersionString - Error %x" (Indicator: "GetVersion"; File: "procdumpexe.exe") Found reference to API "GetVersionFromProcess - Error %x (E_INVALIDARG) - CLR Not Loaded" (Indicator: "GetVersion"; File: "procdumpexe.exe") Found reference to API "GetVersionFromProcess - Error %x" (Indicator: "GetVersion"; File: "procdumpexe.exe") Found reference to API "ICLRRuntimeInfo->GetVersionString - Error %x" (Indicator: "GetVersion"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API "GetVersionFromProcess - Error %x (E_INVALIDARG) - CLR Not Loaded" (Indicator: "GetVersion"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API "GetVersionFromProcess - Error %x" (Indicator: "GetVersion"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API "GetVersionFromProcess" (Indicator: "GetVersion"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp")2d:T178f,"procdumpexe.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005084) "procdumpexe.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005084) "procdumpexe.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005084) "procdumpexe.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005084) "procdumpexe.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005084) "procdumpexe.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005084) "procdumpexe.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005084) "procdumpexe.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005084) "procdumpexe.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005084) "procdumpexe.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005084) "procdumpexe.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005084) "procdumpexe.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005084) "procdumpexe.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005084) "procdumpexe.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005084) "procdumpexe.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005084) "procdumpexe.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005084) "procdumpexe.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005084) "procdumpexe.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005084) "procdumpexe.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005084) "procdumpexe.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005084) "procdumpexe.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005084) "procdumpexe.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005084) "procdumpexe.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005084) "procdumpexe.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005084) "procdumpexe.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005084) "procdumpexe.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005084) "procdumpexe.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005084) "procdumpexe.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005084) "procdumpexe.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005084) "procdumpexe.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005084) "procdumpexe.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005084) "procdumpexe.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005084) "procdumpexe.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005084) "procdumpexe.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005084) "procdumpexe.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005084) "procdumpexe.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005084) "procdumpexe.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005084) "procdumpexe.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005084) "procdumpexe.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005084) "procdumpexe.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005084) "procdumpexe.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005084) "procdumpexe.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005084) "procdumpexe.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005084) "procdumpexe.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005084) "procdumpexe.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005084) "procdumpexe.exe" called "GetProcAddress" with a parameter SetThreadStackGuarantee (UID: 00000000-00005084) "procdumpexe.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00005084) "procdumpexe.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00005084) "procdumpexe.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00005084) "procdumpexe.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00005084) "procdumpexe.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00005084) "procdumpexe.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00005084) "procdumpexe.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00005084) "procdumpexe.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleExW (UID: 00000000-00005084) "procdumpexe.exe" called "GetProcAddress" with a parameter SetFileInformationByHandleW (UID: 00000000-00005084) "procdumpexe.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00005084) "procdumpexe.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00005084)2e:Tccb4,Found reference to API (Indicator: "FlsAlloc"; File: "procdumpexe.exe") Found reference to API (Indicator: "FlsFree"; File: "procdumpexe.exe") Found reference to API (Indicator: "FlsGetValue"; File: "procdumpexe.exe") Found reference to API (Indicator: "FlsSetValue"; File: "procdumpexe.exe") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "procdumpexe.exe") Found reference to API (Indicator: "CreateEventExW"; File: "procdumpexe.exe") Found reference to API (Indicator: "CreateSemaphoreExW"; File: "procdumpexe.exe") Found reference to API (Indicator: "SetThreadStackGuarantee"; File: "procdumpexe.exe") Found reference to API (Indicator: "CreateThreadpoolTimer"; File: "procdumpexe.exe") Found reference to API (Indicator: "SetThreadpoolTimer"; File: "procdumpexe.exe") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; File: "procdumpexe.exe") Found reference to API (Indicator: "CloseThreadpoolTimer"; File: "procdumpexe.exe") Found reference to API (Indicator: "CreateThreadpoolWait"; File: "procdumpexe.exe") Found reference to API (Indicator: "SetThreadpoolWait"; File: "procdumpexe.exe") Found reference to API (Indicator: "CloseThreadpoolWait"; File: "procdumpexe.exe") Found reference to API (Indicator: "FlushProcessWriteBuffers"; File: "procdumpexe.exe") Found reference to API (Indicator: "FreeLibraryWhenCallbackReturns"; File: "procdumpexe.exe") Found reference to API (Indicator: "GetCurrentProcessorNumber"; File: "procdumpexe.exe") Found reference to API (Indicator: "GetLogicalProcessorInformation"; File: "procdumpexe.exe") Found reference to API (Indicator: "CreateSymbolicLinkW"; File: "procdumpexe.exe") Found reference to API (Indicator: "SetDefaultDllDirectories"; File: "procdumpexe.exe") Found reference to API (Indicator: "EnumSystemLocalesEx"; File: "procdumpexe.exe") Found reference to API (Indicator: "CompareStringEx"; File: "procdumpexe.exe") Found reference to API (Indicator: "GetDateFormatEx"; File: "procdumpexe.exe") Found reference to API (Indicator: "GetLocaleInfoEx"; File: "procdumpexe.exe") Found reference to API (Indicator: "GetTimeFormatEx"; File: "procdumpexe.exe") Found reference to API (Indicator: "GetUserDefaultLocaleName"; File: "procdumpexe.exe") Found reference to API (Indicator: "IsValidLocaleName"; File: "procdumpexe.exe") Found reference to API (Indicator: "LCMapStringEx"; File: "procdumpexe.exe") Found reference to API (Indicator: "GetTickCount64"; File: "procdumpexe.exe") Found reference to API (Indicator: "MessageBoxW"; File: "procdumpexe.exe") Found reference to API (Indicator: "GetActiveWindow"; File: "procdumpexe.exe") Found reference to API (Indicator: "GetLastActivePopup"; File: "procdumpexe.exe") Found reference to API (Indicator: "GetUserObjectInformationW"; File: "procdumpexe.exe") Found reference to API (Indicator: "GetProcessWindowStation"; File: "procdumpexe.exe") Found reference to API (Indicator: "CreateFile2"; File: "procdumpexe.exe") Found reference to API (Indicator: "CommandLineToArgvW"; File: "procdumpexe.exe") Found reference to API (Indicator: "GetProcessMemoryInfo"; File: "procdumpexe.exe") Found reference to API (Indicator: "NtQuerySystemInformation"; File: "procdumpexe.exe") Found reference to API (Indicator: "RtlGetLastNtStatus"; File: "procdumpexe.exe") Found reference to API (Indicator: "IsWow64Process"; File: "procdumpexe.exe") Found reference to API (Indicator: "K32GetModuleFileNameExW"; File: "procdumpexe.exe") Found reference to API (Indicator: "GetModuleFileNameExW"; File: "procdumpexe.exe") Found reference to API (Indicator: "GetPackageFullName"; File: "procdumpexe.exe") Found reference to API (Indicator: "NtResumeProcess"; File: "procdumpexe.exe") Found reference to API (Indicator: "RtlCreateProcessReflection"; File: "procdumpexe.exe") Found reference to API (Indicator: "EnumProcessModules"; File: "procdumpexe.exe") Found reference to API (Indicator: "GetFileVersionInfoW"; File: "procdumpexe.exe") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; File: "procdumpexe.exe") Found reference to API (Indicator: "VerQueryValueW"; File: "procdumpexe.exe") Found reference to API (Indicator: "StrStrIW"; File: "procdumpexe.exe") Found reference to API (Indicator: "CreateEventW"; File: "procdumpexe.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "procdumpexe.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "procdumpexe.exe") Found reference to API (Indicator: "LoadLibraryW"; File: "procdumpexe.exe") Found reference to API (Indicator: "GetStdHandle"; File: "procdumpexe.exe") Found reference to API (Indicator: "GetProcAddress"; File: "procdumpexe.exe") Found reference to API (Indicator: "LocalAlloc"; File: "procdumpexe.exe") Found reference to API (Indicator: "GetFileType"; File: "procdumpexe.exe") Found reference to API (Indicator: "LocalFree"; File: "procdumpexe.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "procdumpexe.exe") Found reference to API (Indicator: "GetVersionExW"; File: "procdumpexe.exe") Found reference to API (Indicator: "InterlockedIncrement"; File: "procdumpexe.exe") Found reference to API (Indicator: "InterlockedDecrement"; File: "procdumpexe.exe") Found reference to API (Indicator: "SetEvent"; File: "procdumpexe.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "procdumpexe.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "procdumpexe.exe") Found reference to API (Indicator: "CloseHandle"; File: "procdumpexe.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "procdumpexe.exe") Found reference to API (Indicator: "Sleep"; File: "procdumpexe.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "procdumpexe.exe") Found reference to API (Indicator: "GetThreadContext"; File: "procdumpexe.exe") Found reference to API (Indicator: "GetTickCount"; File: "procdumpexe.exe") Found reference to API (Indicator: "ReadProcessMemory"; File: "procdumpexe.exe") Found reference to API (Indicator: "OpenThread"; File: "procdumpexe.exe") Found reference to API (Indicator: "DebugActiveProcess"; File: "procdumpexe.exe") Found reference to API (Indicator: "DebugActiveProcessStop"; File: "procdumpexe.exe") Found reference to API (Indicator: "FindResourceW"; File: "procdumpexe.exe") Found reference to API (Indicator: "FreeLibrary"; File: "procdumpexe.exe") Found reference to API (Indicator: "LoadResource"; File: "procdumpexe.exe") Found reference to API (Indicator: "CreateProcessW"; File: "procdumpexe.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "procdumpexe.exe") Found reference to API (Indicator: "InitializeCriticalSection"; File: "procdumpexe.exe") Found reference to API (Indicator: "OpenProcess"; File: "procdumpexe.exe") Found reference to API (Indicator: "SizeofResource"; File: "procdumpexe.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "procdumpexe.exe") Found reference to API (Indicator: "GetFileAttributesW"; File: "procdumpexe.exe") Found reference to API (Indicator: "GetLastError"; File: "procdumpexe.exe") Found reference to API (Indicator: "SetLastError"; File: "procdumpexe.exe") Found reference to API (Indicator: "LockResource"; File: "procdumpexe.exe") Found reference to API (Indicator: "ContinueDebugEvent"; File: "procdumpexe.exe") Found reference to API (Indicator: "WaitForDebugEvent"; File: "procdumpexe.exe") Found reference to API (Indicator: "DeleteFileW"; File: "procdumpexe.exe") Found reference to API (Indicator: "ResumeThread"; File: "procdumpexe.exe") Found reference to API (Indicator: "CreateThread"; File: "procdumpexe.exe") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; File: "procdumpexe.exe") Found reference to API (Indicator: "FormatMessageW"; File: "procdumpexe.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "procdumpexe.exe") Found reference to API (Indicator: "TerminateProcess"; File: "procdumpexe.exe") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "procdumpexe.exe") Found reference to API (Indicator: "GetFullPathNameW"; File: "procdumpexe.exe") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; File: "procdumpexe.exe") Found reference to API (Indicator: "GetEnvironmentVariableA"; File: "procdumpexe.exe") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "procdumpexe.exe") Found reference to API (Indicator: "Process32FirstW"; File: "procdumpexe.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "procdumpexe.exe") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "procdumpexe.exe") Found reference to API (Indicator: "Process32NextW"; File: "procdumpexe.exe") Found reference to API (Indicator: "IsDebuggerPresent"; File: "procdumpexe.exe") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; File: "procdumpexe.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "procdumpexe.exe") Found reference to API (Indicator: "DebugBreak"; File: "procdumpexe.exe") Found reference to API (Indicator: "GetSystemTime"; File: "procdumpexe.exe") Found reference to API (Indicator: "CreateFileW"; File: "procdumpexe.exe") Found reference to API (Indicator: "GetFileSizeEx"; File: "procdumpexe.exe") Found reference to API (Indicator: "ExitProcess"; File: "procdumpexe.exe") Found reference to API (Indicator: "GetDateFormatW"; File: "procdumpexe.exe") Found reference to API (Indicator: "SetFilePointerEx"; File: "procdumpexe.exe") Found reference to API (Indicator: "GetTimeFormatW"; File: "procdumpexe.exe") Found reference to API (Indicator: "ReleaseSemaphore"; File: "procdumpexe.exe") Found reference to API (Indicator: "CreateSemaphoreW"; File: "procdumpexe.exe") Found reference to API (Indicator: "GetProcessId"; File: "procdumpexe.exe") Found reference to API (Indicator: "DeviceIoControl"; File: "procdumpexe.exe") Found reference to API (Indicator: "VirtualQueryEx"; File: "procdumpexe.exe") Found reference to API (Indicator: "SetWindowTextW"; File: "procdumpexe.exe") Found reference to API (Indicator: "GetSysColorBrush"; File: "procdumpexe.exe") Found reference to API (Indicator: "InflateRect"; File: "procdumpexe.exe") Found reference to API (Indicator: "LoadCursorW"; File: "procdumpexe.exe") Found reference to API (Indicator: "SetCursor"; File: "procdumpexe.exe") Found reference to API (Indicator: "LoadStringA"; File: "procdumpexe.exe") Found reference to API (Indicator: "GetWindowThreadProcessId"; File: "procdumpexe.exe") Found reference to API (Indicator: "IsWindowVisible"; File: "procdumpexe.exe") Found reference to API (Indicator: "EnumWindows"; File: "procdumpexe.exe") Found reference to API (Indicator: "wsprintfW"; File: "procdumpexe.exe") Found reference to API (Indicator: "SetMapMode"; File: "procdumpexe.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "procdumpexe.exe") Found reference to API (Indicator: "RegCreateKeyW"; File: "procdumpexe.exe") Found reference to API (Indicator: "RegQueryValueExW"; File: "procdumpexe.exe") Found reference to API (Indicator: "RegOpenKeyExW"; File: "procdumpexe.exe") Found reference to API (Indicator: "RegCloseKey"; File: "procdumpexe.exe") Found reference to API (Indicator: "RegSetValueExW"; File: "procdumpexe.exe") Found reference to API (Indicator: "RegCreateKeyExW"; File: "procdumpexe.exe") Found reference to API (Indicator: "RegDeleteKeyW"; File: "procdumpexe.exe") Found reference to API (Indicator: "RegDeleteValueW"; File: "procdumpexe.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "procdumpexe.exe") Found reference to API (Indicator: "LookupPrivilegeValueW"; File: "procdumpexe.exe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "procdumpexe.exe") Found reference to API (Indicator: "CloseServiceHandle"; File: "procdumpexe.exe") Found reference to API (Indicator: "OpenSCManagerW"; File: "procdumpexe.exe") Found reference to API (Indicator: "EnumServicesStatusExW"; File: "procdumpexe.exe") Found reference to API (Indicator: "CoUninitialize"; File: "procdumpexe.exe") Found reference to API (Indicator: "CoInitializeEx"; File: "procdumpexe.exe") Found reference to API (Indicator: "CoCreateInstance"; File: "procdumpexe.exe") Found reference to API (Indicator: "CLSIDFromString"; File: "procdumpexe.exe") Found reference to API (Indicator: "EncodePointer"; File: "procdumpexe.exe") Found reference to API (Indicator: "DecodePointer"; File: "procdumpexe.exe") Found reference to API (Indicator: "HeapFree"; File: "procdumpexe.exe") Found reference to API (Indicator: "HeapAlloc"; File: "procdumpexe.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "procdumpexe.exe") Found reference to API (Indicator: "ReadConsoleInputA"; File: "procdumpexe.exe") Found reference to API (Indicator: "SetConsoleMode"; File: "procdumpexe.exe") Found reference to API (Indicator: "GetModuleHandleExW"; File: "procdumpexe.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "procdumpexe.exe") Found reference to API (Indicator: "SetStdHandle"; File: "procdumpexe.exe") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "procdumpexe.exe") Found reference to API (Indicator: "RaiseException"; File: "procdumpexe.exe") Found reference to API (Indicator: "RtlUnwind"; File: "procdumpexe.exe") Found reference to API (Indicator: "HeapSize"; File: "procdumpexe.exe") Found reference to API (Indicator: "IsValidCodePage"; File: "procdumpexe.exe") Found reference to API (Indicator: "GetACP"; File: "procdumpexe.exe") Found reference to API (Indicator: "GetOEMCP"; File: "procdumpexe.exe") Found reference to API (Indicator: "GetCPInfo"; File: "procdumpexe.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "procdumpexe.exe") Found reference to API (Indicator: "GetProcessHeap"; File: "procdumpexe.exe") Found reference to API (Indicator: "WriteFile"; File: "procdumpexe.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "procdumpexe.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "procdumpexe.exe") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "procdumpexe.exe") Found reference to API (Indicator: "TlsAlloc"; File: "procdumpexe.exe") Found reference to API (Indicator: "TlsGetValue"; File: "procdumpexe.exe") Found reference to API (Indicator: "TlsSetValue"; File: "procdumpexe.exe") Found reference to API (Indicator: "TlsFree"; File: "procdumpexe.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "procdumpexe.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "procdumpexe.exe") Found reference to API (Indicator: "ReadFile"; File: "procdumpexe.exe") Found reference to API (Indicator: "FlushFileBuffers"; File: "procdumpexe.exe") Found reference to API (Indicator: "GetConsoleCP"; File: "procdumpexe.exe") Found reference to API (Indicator: "GetStringTypeW"; File: "procdumpexe.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "procdumpexe.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "procdumpexe.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "procdumpexe.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "procdumpexe.exe") Found reference to API (Indicator: "HeapReAlloc"; File: "procdumpexe.exe") Found reference to API (Indicator: "LCMapStringW"; File: "procdumpexe.exe") Found reference to API (Indicator: "OutputDebugStringW"; File: "procdumpexe.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "procdumpexe.exe") Found reference to API (Indicator: "ReadConsoleW"; File: "procdumpexe.exe") Found reference to API (Indicator: "SetEndOfFile"; File: "procdumpexe.exe") Found reference to API (Indicator: "RtlPcToFileHeader"; File: "procdumpexe.exe") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "procdumpexe.exe") Found reference to API (Indicator: "RtlCaptureContext"; File: "procdumpexe.exe") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "procdumpexe.exe") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "CreateEventExW"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "SetThreadStackGuarantee"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWait"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolWait"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWait"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "FlushProcessWriteBuffers"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "FreeLibraryWhenCallbackReturns"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessorNumber"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "GetLogicalProcessorInformation"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "CreateSymbolicLinkW"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "SetDefaultDllDirectories"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesEx"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatEx"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatEx"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "IsValidLocaleName"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "GetUserObjectInformationW"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "CreateFile2"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "CommandLineToArgvW"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "GetProcessMemoryInfo"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "NtQuerySystemInformation"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "RtlGetLastNtStatus"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "K32GetModuleFileNameExW"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameExW"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "GetPackageFullName"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "NtResumeProcess"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "RtlCreateProcessReflection"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "EnumProcessModules"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "StrStrIW"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "InterlockedIncrement"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp") Found reference to API (Indicator: "InterlockedDecrement"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "GetThreadContext"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "ReadProcessMemory"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "OpenThread"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "DebugActiveProcess"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "DebugActiveProcessStop"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp") Found reference to API (Indicator: "ContinueDebugEvent"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "WaitForDebugEvent"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleCtrlHandler"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableA"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "Process32FirstW"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "Process32NextW"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "DebugBreak"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTime"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatW"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatW"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreW"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "GetProcessId"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "DeviceIoControl"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "VirtualQueryEx"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextW"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "GetSysColorBrush"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "InflateRect"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "LoadCursorW"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "SetCursor"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "IsWindowVisible"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "EnumWindows"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "wsprintfW"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "SetMapMode"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyW"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyW"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "OpenSCManagerW"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "EnumServicesStatusExW"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "CLSIDFromString"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleInputA"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleMode"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "RtlPcToFileHeader"; Source: "00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00005084.00000000.105649.009EA000.00000002.mdmp")2f:T827,Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "procdumpexe.exe") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "procdumpexe.exe") Found reference to API "ICorDebugManagedCallback::CreateThread" (Indicator: "CreateThread"; File: "procdumpexe.exe") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "procdumpexe.exe") Found reference to API "OpenThread" (Indicator: "OpenThread"; File: "procdumpexe.exe") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "procdumpexe.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "procdumpexe.exe") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API "ICorDebugManagedCallback::CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp")30:T1699,"Software\Sysinternals\%s" in Source: procdumpexe.exe "Software\Microsoft\windows nt\currentversion" in Source: procdumpexe.exe "Software\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels" in Source: procdumpexe.exe "Software\Sysinternals" in Source: procdumpexe.exe "Error deleting HKLM\SOFTWARE\%sMicrosoft\Windows NT\CurrentVersion\AeDebug\ProcDump\" in Source: procdumpexe.exe "Error deleting HKLM\SOFTWARE\%sMicrosoft\Windows NT\CurrentVersion\AeDebug\Auto" in Source: procdumpexe.exe "Error deleting HKLM\SOFTWARE\%sMicrosoft\Windows NT\CurrentVersion\AeDebug\Debugger" in Source: procdumpexe.exe "Error setting HKLM\SOFTWARE\%sMicrosoft\Windows NT\CurrentVersion\AeDebug\Auto" in Source: procdumpexe.exe "Error setting HKLM\SOFTWARE\%sMicrosoft\Windows NT\CurrentVersion\AeDebug\Debugger" in Source: procdumpexe.exe "HKLM\SOFTWARE\%sMicrosoft\Windows NT\CurrentVersion\AeDebug" in Source: procdumpexe.exe "ProcDump's backup key is missing. Defaulting to value deletion. HKLM\SOFTWARE\%sMicrosoft\Windows NT\CurrentVersion\AeDebug\ProcDump\" in Source: procdumpexe.exe "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug" in Source: procdumpexe.exe "Error opening HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug" in Source: procdumpexe.exe "Error opening HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\AeDebug" in Source: procdumpexe.exe "nSOFTWARE\Microsoft\.NETFramework" in Source: procdumpexe.exe "SOFTWARE\Microsoft\Silverlight" in Source: procdumpexe.exe "SOFTWARE\Microsoft\Windows Kits\Installed Roots" in Source: procdumpexe.exe "SOFTWARE\Microsoft\DebuggingTools" in Source: procdumpexe.exe "SOFTWARE\Microsoft\.NETFramework" in Source: procdumpexe.exe "leting HKLM\SOFTWARE\%sMicrosoft\Windows NT\CurrentVersion\AeDebug\ProcDump\" in Source: procdumpexe.exe "ror deleting HKLM\SOFTWARE\%sMicrosoft\Windows NT\CurrentVersion\AeDebug\Debugger" in Source: procdumpexe.exe "r deleting HKLM\SOFTWARE\%sMicrosoft\Windows NT\CurrentVersion\AeDebug\ProcDump\" in Source: procdumpexe.exe "opening HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug" in Source: procdumpexe.exe "Software\Sysinternals\%s" in Source: 00000000-00005084.00000000.105649.009CA000.00000002.mdmp 00000000-00005084.00000000.105649.009EA000.00000002.mdmp "Software\Microsoft\windows nt\currentversion" in Source: 00000000-00005084.00000000.105649.009CA000.00000002.mdmp 00000000-00005084.00000000.105649.009EA000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels" in Source: 00000000-00005084.00000000.105649.009CA000.00000002.mdmp 00000000-00005084.00000000.105649.009EA000.00000002.mdmp "Software\Sysinternals" in Source: 00000000-00005084.00000000.105649.009CA000.00000002.mdmp 00000000-00005084.00000000.105649.009EA000.00000002.mdmp "Error deleting HKLM\SOFTWARE\%sMicrosoft\Windows NT\CurrentVersion\AeDebug\ProcDump\" in Source: 00000000-00005084.00000000.105649.009CA000.00000002.mdmp 00000000-00005084.00000000.105649.009EA000.00000002.mdmp "Error deleting HKLM\SOFTWARE\%sMicrosoft\Windows NT\CurrentVersion\AeDebug\Auto" in Source: 00000000-00005084.00000000.105649.009CA000.00000002.mdmp 00000000-00005084.00000000.105649.009EA000.00000002.mdmp "Error deleting HKLM\SOFTWARE\%sMicrosoft\Windows NT\CurrentVersion\AeDebug\Debugger" in Source: 00000000-00005084.00000000.105649.009CA000.00000002.mdmp 00000000-00005084.00000000.105649.009EA000.00000002.mdmp "Error setting HKLM\SOFTWARE\%sMicrosoft\Windows NT\CurrentVersion\AeDebug\Auto" in Source: 00000000-00005084.00000000.105649.009CA000.00000002.mdmp 00000000-00005084.00000000.105649.009EA000.00000002.mdmp "Error setting HKLM\SOFTWARE\%sMicrosoft\Windows NT\CurrentVersion\AeDebug\Debugger" in Source: 00000000-00005084.00000000.105649.009CA000.00000002.mdmp 00000000-00005084.00000000.105649.009EA000.00000002.mdmp "HKLM\SOFTWARE\%sMicrosoft\Windows NT\CurrentVersion\AeDebug" in Source: 00000000-00005084.00000000.105649.009CA000.00000002.mdmp 00000000-00005084.00000000.105649.009EA000.00000002.mdmp "HKLM\SOFTWARE\%sMicrosoft\Windows NT\CurrentVersion\AeDebug\ProcDump\" in Source: 00000000-00005084.00000000.105649.009CA000.00000002.mdmp 00000000-00005084.00000000.105649.009EA000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug" in Source: 00000000-00005084.00000000.105649.009CA000.00000002.mdmp 00000000-00005084.00000000.105649.009EA000.00000002.mdmp "Error opening HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug" in Source: 00000000-00005084.00000000.105649.009CA000.00000002.mdmp 00000000-00005084.00000000.105649.009EA000.00000002.mdmp "Error opening HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\AeDebug" in Source: 00000000-00005084.00000000.105649.009CA000.00000002.mdmp 00000000-00005084.00000000.105649.009EA000.00000002.mdmp "SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00005084.00000000.105649.009CA000.00000002.mdmp 00000000-00005084.00000000.105649.009EA000.00000002.mdmp "SOFTWARE\Microsoft\Silverlight" in Source: 00000000-00005084.00000000.105649.009CA000.00000002.mdmp 00000000-00005084.00000000.105649.009EA000.00000002.mdmp "SOFTWARE\Microsoft\Windows Kits\Installed Roots" in Source: 00000000-00005084.00000000.105649.009CA000.00000002.mdmp 00000000-00005084.00000000.105649.009EA000.00000002.mdmp "SOFTWARE\Microsoft\DebuggingTools" in Source: 00000000-00005084.00000000.105649.009CA000.00000002.mdmp 00000000-00005084.00000000.105649.009EA000.00000002.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005084.00000000.105649.03380000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00005084.00000000.105649.03380000.00000004.mdmp31:T4cf,"procdumpexe.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74740000 "procdumpexe.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74740000 "procdumpexe.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74740000 "procdumpexe.exe" loaded module "KERNEL32" at base 74d50000 "procdumpexe.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73020000 "procdumpexe.exe" loaded module "KERNEL32.DLL" at base 74d50000 "procdumpexe.exe" loaded module "RICHED32.DLL" at base 73010000 "procdumpexe.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73fb0000 "procdumpexe.exe" loaded module "COMCTL32" at base 73770000 "procdumpexe.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 77010000 "procdumpexe.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 76ca0000 "procdumpexe.exe" loaded module "OLEAUT32.DLL" at base 74680000 "procdumpexe.exe" loaded module "RPCRT4.DLL" at base 77160000 "procdumpexe.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 74920000 "procdumpexe.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 74920000 "procdumpexe.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 7525000032:T6af,"procdumpexe.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "procdumpexe.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "procdumpexe.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "procdumpexe.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CONHOST.EXE"; Key: ""; Value: "") "procdumpexe.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: ""; Value: "") "procdumpexe.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\BAM"; Key: ""; Value: "") "procdumpexe.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "procdumpexe.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "procdumpexe.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "procdumpexe.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "procdumpexe.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "procdumpexe.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "procdumpexe.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "")33:Ta96,"procdumpexe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "procdumpexe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "PROCDUMPEXE.EXE"; Value: "") "procdumpexe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "procdumpexe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "procdumpexe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "procdumpexe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "procdumpexe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "procdumpexe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "procdumpexe.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "procdumpexe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "procdumpexe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "procdumpexe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "procdumpexe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "procdumpexe.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "procdumpexe.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "procdumpexe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "procdumpexe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "procdumpexe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "procdumpexe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "")34:T409,"procdumpexe.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "procdumpexe.exe" trying to access non-existent file "C:\VERSION.DLL" "procdumpexe.exe" trying to access non-existent file "C:\PDH.DLL" "procdumpexe.exe" trying to access non-existent file "C:\FLTLIB.DLL" "procdumpexe.exe" trying to access non-existent file "C:\RICHED32.DLL" "procdumpexe.exe" trying to access non-existent file "C:\Riched32.dll" "procdumpexe.exe" trying to access non-existent file "C:\RICHED20.DLL" "procdumpexe.exe" trying to access non-existent file "C:\RICHED20.dll" "procdumpexe.exe" trying to access non-existent file "C:\USP10.DLL" "procdumpexe.exe" trying to access non-existent file "C:\USP10.dll" "procdumpexe.exe" trying to access non-existent file "C:\MSLS31.DLL" "procdumpexe.exe" trying to access non-existent file "C:\msls31.dll" "procdumpexe.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "procdumpexe.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll"35:T8e8,Found URL "http://www.microsoft.com/exporting" - Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp") Found URL "http://www.microsoft.com/exporting" - Source: "00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0hhttp://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0=zyud$2(>cioycom1" - Source: "00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0ycvded/_&" - Source: "00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0.tq[m*$" - Source: "00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found URL "http://www.sysinternals.com" - Source: "00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/miccodsigpca2011_2011-07-08.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/miccodsigpca2011_2011-07-08.crt0&" - Source: "00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt03http://www.microsoft.com/pkiops/docs/primarycps.htm0@e_.,>d=xz" - Source: "00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0l" - Source: "00000000-00005084.00000000.105649.009EA000.00000002.mdmp")36:T553,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005084.00000000.105649.03380000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005084.00000000.105649.03380000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00005084.00000000.105649.03380000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005084.00000000.105649.03380000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005084.00000000.105649.03380000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00005084.00000000.105649.03380000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00005084.00000000.105649.03380000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00005084.00000000.105649.03380000.00000004.mdmp")37:Td35,Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; File: "procdumpexe.exe") Found reference to API "SymEnumProcesses" (Indicator: "EnumProcesses"; File: "procdumpexe.exe") Found reference to API "EnumProcessModules" (Indicator: "EnumProcessModules"; File: "procdumpexe.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "procdumpexe.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "procdumpexe.exe") Found reference to API "Process32FirstW" (Indicator: "Process32First"; File: "procdumpexe.exe") Found reference to API "Process32NextW" (Indicator: "Process32Next"; File: "procdumpexe.exe") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "procdumpexe.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "procdumpexe.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "procdumpexe.exe") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "procdumpexe.exe") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API "SymEnumProcesses" (Indicator: "EnumProcesses"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API "EnumProcessModules" (Indicator: "EnumProcessModules"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp")38:T8a1,Found reference to API "GetFileInformationByHandleExW" (Indicator: "GetFileInformationByHandle"; File: "procdumpexe.exe") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; File: "procdumpexe.exe") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; File: "procdumpexe.exe") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; File: "procdumpexe.exe") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "procdumpexe.exe") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "procdumpexe.exe") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "procdumpexe.exe") Found reference to API "GetFileInformationByHandleExW" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp")39:T510,Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "procdumpexe.exe") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "procdumpexe.exe") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "procdumpexe.exe") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "procdumpexe.exe") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp")3a:T4b0,Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "procdumpexe.exe") Found reference to API "ICorDebugManagedCallback::ExitProcess" (Indicator: "ExitProcess"; File: "procdumpexe.exe") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "procdumpexe.exe") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "procdumpexe.exe") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API "ICorDebugManagedCallback::ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp")3b:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"05732e84de58a3cc142535431b3aa04efbe034cc96e837f93c360a6387d8faad","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"clean","threat_score":0,"unified_at_epoch_ms":1790508331757,"unified_at":"2026-09-27T11:25:31.757Z","metadata":{"hashes":{"sha256":"05732e84de58a3cc142535431b3aa04efbe034cc96e837f93c360a6387d8faad","sha1":"d1387f3c94464d81f1a64207315b13bf578fd10c","md5":"6a09bc6c19c4236c0bd8a01953371a29","sha512":"6ca5d6167a01de2e62b5cf6d850784e90045794f751b246b779db740a754eb66cfd9f3edb659d41b8380ba5807b902897aea5ddd1ad787a0cc318108577286ab","ssdeep":"12288:JyC66C4C6r/uuxQXygjzqU/2Jg5V2/gU7R:J93C1ygjzdvEgq","ssdeep_chunks":["12288:JyC66C4","12288:yC66C4C","12288:C66C4C6","12288:66C4C6r","12288:6C4C6r/","12288:C4C6r/u","12288:4C6r/uu","12288:C6r/uux","12288:6r/uuxQ","12288:r/uuxQX","12288:/uuxQXy","12288:uuxQXyg","12288:uxQXygj","12288:xQXygjz","12288:QXygjzq","12288:XygjzqU","12288:ygjzqU/","12288:gjzqU/2","12288:jzqU/2J","12288:zqU/2Jg","12288:qU/2Jg5","12288:U/2Jg5V","12288:/2Jg5V2","12288:2Jg5V2/","12288:Jg5V2/g","12288:g5V2/gU","12288:5V2/gU7","12288:V2/gU7R","24576:JyC66C4","24576:yC66C4C","24576:C66C4C6","24576:66C4C6r","24576:6C4C6r/","24576:C4C6r/u","24576:4C6r/uu","24576:C6r/uux","24576:6r/uuxQ","24576:r/uuxQX","24576:/uuxQXy","24576:uuxQXyg","24576:uxQXygj","24576:xQXygjz","24576:QXygjzq","24576:XygjzqU","24576:ygjzqU/","24576:gjzqU/2","24576:jzqU/2J","24576:zqU/2Jg","24576:qU/2Jg5","24576:U/2Jg5V","24576:/2Jg5V2","24576:2Jg5V2/","24576:Jg5V2/g","24576:g5V2/gU","24576:5V2/gU7","24576:V2/gU7R","12288:J93C1yg","12288:93C1ygj","12288:3C1ygjz","12288:C1ygjzd","12288:1ygjzdv","12288:ygjzdvE","12288:gjzdvEg","12288:jzdvEgq"],"imphash":"fad4245d83e8982f975b4b8f2f4d5719"},"file_info":{"file_name":"mysqlsqa.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":651424,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1520770729000,"last_seen":1728588753000,"last_multi_scan":1728588753000}},"detections":{"summary":{"verdict":"clean","score":0,"tags":["tag","malware","chir","expiro","floxif","hacktool","metasploit","meterpreter","mofksys","neshta","netwire","netwiredrc","parite","patched","rat","qhost","rozena","swrort","tiggre"]},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":55},"sandbox_signatures":{"informative_count":109,"suspicious_count":17,"malicious_count":2,"total":128},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"whitelisted","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Execution","technique":"Dynamic Data Exchange","attack_id":"T1173","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1173","identifiers":[{"type":"suspicious","value":"The input sample contains an embedded RTF document"}],"sources":[{"report_type":"sandbox","report_id":"5d256ff30288387817e9d9d0"},{"report_type":"sandbox","report_id":"5aa51c8bde71add1debff45d"},{"report_type":"sandbox","report_id":"5aa51ccd7ca3e1249a3a4558"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1116","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1116","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"5d256ff30288387817e9d9d0"},{"report_type":"sandbox","report_id":"5aa51c8bde71add1debff45d"},{"report_type":"sandbox","report_id":"5aa51ccd7ca3e1249a3a4558"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"informative","value":"Loads rich edit control libraries"},{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5aa51c8bde71add1debff45d"},{"report_type":"sandbox","report_id":"5aa51ccd7ca3e1249a3a4558"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"},{"type":"suspicious","value":"Contains ability to enumerate processes/modules/threads"}],"sources":[{"report_type":"sandbox","report_id":"5aa51c8bde71add1debff45d"},{"report_type":"sandbox","report_id":"5aa51ccd7ca3e1249a3a4558"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1045","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1045","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5aa51c8bde71add1debff45d"},{"report_type":"sandbox","report_id":"5aa51ccd7ca3e1249a3a4558"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Queries registry keys"},{"type":"suspicious","value":"Reads information about supported languages"},{"type":"suspicious","value":"Reads the active computer name"},{"type":"suspicious","value":"Read windows product name from registry"}],"sources":[{"report_type":"sandbox","report_id":"5aa51c8bde71add1debff45d"},{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"},{"report_type":"sandbox","report_id":"5aa51ccd7ca3e1249a3a4558"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1120","identifiers":[{"type":"suspicious","value":"Contains ability to enumerate services"}],"sources":[{"report_type":"sandbox","report_id":"5aa51c8bde71add1debff45d"},{"report_type":"sandbox","report_id":"5aa51ccd7ca3e1249a3a4558"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"suspicious","value":"Contains ability to retrieve the fully qualified path of module"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"suspicious","value":"Contains ability to retrieve the command-line string for the current process"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads rich edit control libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"},{"type":"informative","value":"The input sample is signed with a valid certificate"}],"sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"malicious","value":"The input sample contains a known anti-VM trick"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"}],"sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"malicious","value":"PE file contains executable resources"}],"sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query system locale (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"}],"sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"suspicious","value":"Contains ability to enumerate processes/modules/threads"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the active computer name"},{"type":"suspicious","value":"Contains ability to retrieve information about the current system"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"}],"sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"suspicious","value":"Contains ability to enumerate services"},{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"}],"sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve default language settings"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"}],"sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"suspicious","value":"YARA signature match - Sysinternal Tool"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains reference to Sysinternals URL"}],"sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]}],"sandbox_signatures":[{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/17 Antivirus vendors marked sample as malicious (0% detection rate)\n 0/67 Antivirus vendors marked sample as malicious (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"5d256ff30288387817e9d9d0"},{"report_type":"sandbox","report_id":"5aa51c8bde71add1debff45d"},{"report_type":"sandbox","report_id":"5aa51ccd7ca3e1249a3a4558"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\Builds\\13810\\Tools\\ProcDump_master\\bin\\Win32\\Release\\procdump.pdb\"\n \"C:\\Builds\\13810\\Tools\\ProcDump_master\\bin\\x64\\Release\\procdump64.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5d256ff30288387817e9d9d0"},{"report_type":"sandbox","report_id":"5aa51c8bde71add1debff45d"},{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"},{"report_type":"sandbox","report_id":"5aa51ccd7ca3e1249a3a4558"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=Microsoft Time-Stamp PCA, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US\" (SHA1: 69:2A:53:F2:A4:C2:24:1A:93:15:78:77:BA:FF:19:F7:41:2D:29:82; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Microsoft Code Signing PCA, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US\" (SHA1: 98:ED:99:A6:78:86:D0:20:C5:64:92:3B:7D:F2:5E:9A:C0:19:DF:26; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Microsoft Root Certificate Authority, DC=microsoft, DC=com\" (SHA1: 3C:AF:9B:A2:DB:55:70:CA:F7:69:42:FF:99:10:1B:99:38:88:E2:57; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Microsoft Root Certificate Authority, DC=microsoft, DC=com\" (SHA1: 37:5F:CB:82:5C:3D:C3:75:2A:02:E3:4E:B7:09:93:B4:99:71:91:EF; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1116","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"5d256ff30288387817e9d9d0"},{"report_type":"sandbox","report_id":"5aa51c8bde71add1debff45d"},{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"},{"report_type":"sandbox","report_id":"5aa51ccd7ca3e1249a3a4558"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$25","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5d256ff30288387817e9d9d0"},{"report_type":"sandbox","report_id":"5aa51c8bde71add1debff45d"},{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"},{"report_type":"sandbox","report_id":"5aa51ccd7ca3e1249a3a4558"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"$26","origin":"File/Memory","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"5d256ff30288387817e9d9d0"},{"report_type":"sandbox","report_id":"5aa51c8bde71add1debff45d"},{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"},{"report_type":"sandbox","report_id":"5aa51ccd7ca3e1249a3a4558"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"The input sample contains an embedded RTF document","description":"\"05732e84de58a3cc142535431b3aa04efbe034cc96e837f93c360a6387d8faad\" has an embedded RTF document (Line: 411; Offset: 391)","origin":"Binary File","mitre_attack_id":"T1173","relevance":10,"id":"binary-3","sources":[{"report_type":"sandbox","report_id":"5d256ff30288387817e9d9d0"}]},{"level":"malicious","category":"Environment Awareness","name":"The input sample contains a known anti-VM trick","description":"Found VM detection artifact \"CPUID trick\" in \"05732e84de58a3cc142535431b3aa04efbe034cc96e837f93c360a6387d8faad\" (Offset: 381571)","origin":"Binary File","relevance":5,"id":"binary-8","sources":[{"report_type":"sandbox","report_id":"5d256ff30288387817e9d9d0"},{"report_type":"sandbox","report_id":"5aa51c8bde71add1debff45d"},{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"},{"report_type":"sandbox","report_id":"5aa51ccd7ca3e1249a3a4558"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 15620-3269-0041CCD3","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5aa51c8bde71add1debff45d"},{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"},{"report_type":"sandbox","report_id":"5aa51ccd7ca3e1249a3a4558"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"Procdump.zip.exe\" loaded module \"%WINDIR%\\System32\\riched32.dll\" at 6D880000\n \"Procdump.zip.exe\" loaded module \"%WINDIR%\\System32\\riched20.dll\" at 6D800000","origin":"Loaded Module","mitre_attack_id":"T1179","id":"module-2","sources":[{"report_type":"sandbox","report_id":"5aa51c8bde71add1debff45d"},{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"},{"report_type":"sandbox","report_id":"5aa51ccd7ca3e1249a3a4558"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"Procdump.zip.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5aa51c8bde71add1debff45d"},{"report_type":"sandbox","report_id":"5aa51ccd7ca3e1249a3a4558"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"Procdump.zip.exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"Procdump.zip.exe\" touched file \"%WINDIR%\\Fonts\\StaticCache.dat\"\n \"Procdump.zip.exe\" touched file \"%WINDIR%\\System32\\en-US\\msctf.dll.mui\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5aa51c8bde71add1debff45d"},{"report_type":"sandbox","report_id":"5aa51ccd7ca3e1249a3a4558"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"Procdump.zip.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5aa51c8bde71add1debff45d"},{"report_type":"sandbox","report_id":"5aa51ccd7ca3e1249a3a4558"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"procdump.exe.bin\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1045","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5aa51c8bde71add1debff45d"},{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"},{"report_type":"sandbox","report_id":"5aa51ccd7ca3e1249a3a4558"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to enumerate services","description":"EnumServicesStatusExW@ADVAPI32.dll at 15620-3072-0040B2D0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1120","relevance":7,"id":"stream-27","sources":[{"report_type":"sandbox","report_id":"5aa51c8bde71add1debff45d"},{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"},{"report_type":"sandbox","report_id":"5aa51ccd7ca3e1249a3a4558"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"Procdump.zip.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5aa51c8bde71add1debff45d"},{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"},{"report_type":"sandbox","report_id":"5aa51ccd7ca3e1249a3a4558"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceW@KERNEL32.dll at 15620-3092-00408D60\n LockResource@KERNEL32.dll at 15620-3093-00408CF0","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"5aa51c8bde71add1debff45d"},{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"},{"report_type":"sandbox","report_id":"5aa51ccd7ca3e1249a3a4558"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"Procdump.zip.exe\" read file \"%WINDIR%\\win.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5aa51c8bde71add1debff45d"},{"report_type":"sandbox","report_id":"5aa51ccd7ca3e1249a3a4558"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.dll at 15620-3072-0040B2D0\n CreateToolhelp32Snapshot@KERNEL32.dll at 15620-3076-0040B1A0\n CreateToolhelp32Snapshot@KERNEL32.dll at 15620-3102-0040B6C0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1215","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"5aa51c8bde71add1debff45d"},{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"},{"report_type":"sandbox","report_id":"5aa51ccd7ca3e1249a3a4558"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCreateKeyExW\n RegDeleteValueW\n RegCloseKey\n OpenProcessToken\n RegOpenKeyExW\n RegCreateKeyW\n RegOpenKeyW\n RegDeleteKeyW\n GetFileAttributesW\n GetThreadContext\n WriteFile\n DeviceIoControl\n OutputDebugStringW\n GetModuleFileNameW\n IsDebuggerPresent\n UnhandledExceptionFilter\n LoadLibraryExW\n CreateThread\n TerminateProcess\n GetModuleHandleExW\n CreateToolhelp32Snapshot\n LoadLibraryW\n GetVersionExW\n GetTickCount\n OpenProcess\n GetStartupInfoW\n ReadProcessMemory\n DeleteFileW\n GetProcAddress\n GetFileSizeEx\n CreateFileW\n Process32NextW\n LockResource\n GetCommandLineW\n Process32FirstW\n GetModuleHandleW\n FindResourceW\n CreateProcessW\n Sleep\n GetWindowThreadProcessId","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5aa51c8bde71add1debff45d"},{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"},{"report_type":"sandbox","report_id":"5aa51ccd7ca3e1249a3a4558"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"Procdump.zip.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5aa51c8bde71add1debff45d"},{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"},{"report_type":"sandbox","report_id":"5aa51ccd7ca3e1249a3a4558"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"procdumpexe.exe\")\n Found reference to API \"WaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; File: \"procdumpexe.exe\")\n Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp\")\n Found reference to API \"WaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"procdumpexe.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"procdumpexe.exe\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00005084.00000000.105649.03380000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00005084.00000000.105649.009EA000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\Global\\ProcmonDebugLogger; Source: \"procdumpexe.exe\")\n Found string - \\\\.\\Global\\ProcmonDebugLogger; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"procdumpexe.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"procdumpexe.exe\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"procdumpexe.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"procdumpexe.exe\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"procdumpexe.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"procdumpexe.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"procdumpexe.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"procdumpexe.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$29","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Found potential URLs in memory dumps","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"procdumpexe.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005084)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2a","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"procdumpexe.exe\" called \"GetVersionExA\" with parameter 940000000600000002000000f02300000200000000000000400b18030000000018f013015916b277010000000800000001000000000038030000000010000000000000000000000002000000020000000000380301000000080000000000000038f01301ee13b27701000000ee13b2770800000000000000080000000100000070f21301ad9cff72000038030800000001000000 (UID: 00000000-00005084)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve default language settings","description":"\"procdumpexe.exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00005084)","origin":"API Call","mitre_attack_id":"T1614.001","relevance":3,"id":"api-149","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.dll at 5186-3062-00411A30\n GetTickCount@KERNEL32.dll at 5186-3103-004061E0\n GetTickCount@KERNEL32.dll at 5186-3078-0040B020","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"procdumpexe.exe\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"procdumpexe.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"procdumpexe.exe\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found reference to API \"EnumSystemLocalesEx\" (Indicator: \"EnumSystemLocales\"; File: \"procdumpexe.exe\")\n Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; File: \"procdumpexe.exe\")\n Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; File: \"procdumpexe.exe\")\n Found reference to API \"EnumSystemLocalesEx\" (Indicator: \"EnumSystemLocales\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"procdumpexe.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"Set to:\" (Indicator: \"set \"; File: \"procdumpexe.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"procdumpexe.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"procdumpexe.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"procdumpexe.exe\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"procdumpexe.exe\")\n Found reference to API \"EnumWindows\" (Indicator: \"EnumWindows\"; File: \"procdumpexe.exe\")\n Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp\")\n Found reference to API \"EnumWindows\" (Indicator: \"EnumWindows\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"procdumpexe.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"OpenProcess@KERNEL32.dll at 5186-3076-0040B1A0\n OpenProcess@KERNEL32.dll at 5186-3231-004119E0\n OpenProcess@KERNEL32.dll at 5186-3099-00407620\n OpenProcessToken@ADVAPI32.dll at 5186-3101-00408B20","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; File: \"procdumpexe.exe\")\n Found reference to API \"EnumServicesStatusExW\" (Indicator: \"EnumServicesStatus\"; File: \"procdumpexe.exe\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp\")\n Found reference to API \"EnumServicesStatusExW\" (Indicator: \"EnumServicesStatus\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"\"procdumpexe.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005084)\n \"procdumpexe.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005084)\n \"procdumpexe.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005084)\n \"procdumpexe.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00005084)\n \"procdumpexe.exe\" called \"LoadLibrary\" with a parameter Riched32.dll (UID: 00000000-00005084)","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2d","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; File: \"procdumpexe.exe\")\n Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"ICorDebugManagedCallback::CreateProcess\" (Indicator: \"CreateProcess\"; File: \"procdumpexe.exe\")\n Found reference to API \"RtlCreateProcessReflection\" (Indicator: \"CreateProcess\"; File: \"procdumpexe.exe\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"procdumpexe.exe\")\n Found reference to API \"ICorDebugManagedCallback::CreateProcess\" (Indicator: \"CreateProcess\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp\")\n Found reference to API \"RtlCreateProcessReflection\" (Indicator: \"CreateProcess\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"procdumpexe.exe\")\n Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegCreateKeyW\" (Indicator: \"RegCreateKey\"; File: \"procdumpexe.exe\")\n Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; File: \"procdumpexe.exe\")\n Found reference to API \"RegCreateKeyW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp\")\n Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFile2\" (Indicator: \"CreateFile\"; File: \"procdumpexe.exe\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"procdumpexe.exe\")\n Found reference to API \"CreateFile2\" (Indicator: \"CreateFile\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"WaitForSingleObject@KERNEL32.dll at 5186-3092-00408D60\n Sleep@KERNEL32.dll at 5186-3072-0040B2D0\n Sleep@KERNEL32.dll at 5186-3081-0040A2B0\n WaitForSingleObject@KERNEL32.dll at 5186-3118-00407FB0\n WaitForSingleObject@KERNEL32.dll at 5186-3126-00405790","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"procdumpexe.exe\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryW@KERNEL32.dll at 5186-3100-00408C10\n LoadLibraryW@KERNEL32.dll at 5186-3048-00412F40\n LoadLibraryW@KERNEL32.dll at 5186-3099-00407620\n LoadLibraryW@KERNEL32.dll at 5186-3118-00407FB0\n LoadLibraryW@KERNEL32.dll at 5186-3148-00403900","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; File: \"procdumpexe.exe\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; File: \"procdumpexe.exe\")\n Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; File: \"procdumpexe.exe\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; File: \"procdumpexe.exe\")\n Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp\")\n Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"General","name":"Contains ability to load modules (API string)","description":"Found reference to API \"ICorDebugManagedCallback::LoadModule\" (Indicator: \"LoadModule\"; File: \"procdumpexe.exe\")\n Found reference to API \"ICorDebugManagedCallback::LoadModule\" (Indicator: \"LoadModule\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-424","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; File: \"procdumpexe.exe\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"procdumpexe.exe\")\n Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"procdumpexe.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"procdumpexe.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"procdumpexe.exe\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"procdumpexe.exe\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"procdumpexe.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"procdumpexe.exe\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"General","name":"Contains reference to Sysinternals URL","description":"Found string \"http://www.sysinternals.com 0\" (Indicator: \"www.sysinternals.com\"; File: \"procdumpexe.exe\")\n Found string \"Sysinternals - www.sysinternals.com\" (Indicator: \"www.sysinternals.com\"; File: \"procdumpexe.exe\")\n Found string \"als - www.sysinternals.com\" (Indicator: \"www.sysinternals.com\"; File: \"procdumpexe.exe\")\n Found string \"Sysinternals - www.sysinternals.com\" (Indicator: \"www.sysinternals.com\"; Source: \"00000000-00005084.00000000.105649.009EA000.00000002.mdmp, 00000000-00005084.00000000.105649.03380000.00000004.mdmp\")\n Found string \"http://www.sysinternals.com 0\" (Indicator: \"www.sysinternals.com\"; Source: \"00000000-00005084.00000000.105649.009EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-262","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$30","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\SM0:5084:168:WilStaging_02\"\n \"SM0:5084:64:WilError_01\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"procdumpexe.exe\" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$31","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"procdumpexe.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 77260000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"procdumpexe.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77160000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"procdumpexe.exe\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"procdumpexe.exe\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"procdumpexe.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"procdumpexe.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"procdumpexe.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"procdumpexe.exe\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"procdumpexe.exe\" file has an entrypoint instructions - \"call\t0x421d99,jmp\t0x41706c,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,push\tedi,push\tesi,mov\tesi, dword ptr [esp + 0x10],mov\tecx, dword ptr [esp + 0x14],mov\tedi, dword ptr [esp + 0xc],mov\teax, ecx,mov\tedx, ecx,add\teax, esi,cmp\tedi, esi,jbe\t0x417220,cmp\tedi, eax,jb\t0x417588,bt\tdword ptr [0x446918], 1,jae\t0x417231,rep movsb\tbyte ptr es:[edi], byte ptr [esi],jmp\t0x417548,cmp\tecx, 0x80,jb\t0x41740b,mov\teax, edi,xor\teax, esi,test\teax, 0xf,jne\t0x417256,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"General","name":"The input sample is signed with a valid certificate","description":"The entire certificate chain of the input sample was validated successfully.","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-2","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"procdumpexe.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$32","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"procdumpexe.exe\" queries basic process information of the \"C:\\procdumpexe.exe\" (UID: 5084)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$33","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"procdumpexe.exe\" reads file \"c:\\windows\\win.ini\"\n \"procdumpexe.exe\" reads file \"c:\\windows\\fonts\\staticcache.dat\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to detect virtual environment (API)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: The input sample contains a known anti-VM trick\n Matched sigs: Contains ability to delay the execution of current thread","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"procdumpexe.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"procdumpexe.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"procdumpexe.exe\" trying to touch file \"C:\\procdumpexe.exe\"\n \"procdumpexe.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"procdumpexe.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"procdumpexe.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"procdumpexe.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"procdumpexe.exe\" trying to touch file \"C:\\VERSION.DLL\"\n \"procdumpexe.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\version.dll\"\n \"procdumpexe.exe\" trying to touch file \"C:\\PROCDUMPEXE.EXE.LOCAL\"\n \"procdumpexe.exe\" trying to touch file \"C:\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.16299.248_none_d0271d135f36f548\\comctl32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$34","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"procdumpexe.exe\" trying to access non-existent file \"C:\\PROCDUMPEXE.EXE.LOCAL\"\n \"procdumpexe.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\UXTHEME.DLL.CONFIG\"\n \"procdumpexe.exe\" trying to access non-existent file \"C:\\procdumpexe.exe.Local\\\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"0.0.0.0\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$35","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e\n Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"procdumpexe.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"Found reference to API \"RegQueryValueExW\" (Indicator: \"RegQueryValue\"; File: \"procdumpexe.exe\")\n Found reference to API \"RegOpenKeyW\" (Indicator: \"RegOpenKey\"; File: \"procdumpexe.exe\")\n Found reference to API \"RegOpenKeyExW\" (Indicator: \"RegOpenKey\"; File: \"procdumpexe.exe\")\n Found reference to API \"RegQueryValueExW\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp\")\n Found reference to API \"RegOpenKeyW\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp\")\n Found reference to API \"RegOpenKeyExW\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"procdumpexe.exe\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"procdumpexe.exe\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"procdumpexe.exe\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"procdumpexe.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; File: \"procdumpexe.exe\")\n Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"K32GetModuleFileNameExW\" (Indicator: \"GetModuleFileName\"; File: \"procdumpexe.exe\")\n Found reference to API \"GetModuleFileNameExW\" (Indicator: \"GetModuleFileName\"; File: \"procdumpexe.exe\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"procdumpexe.exe\")\n Found reference to API \"K32GetModuleFileNameExW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameExW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; File: \"procdumpexe.exe\")\n Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"procdumpexe.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"procdumpexe.exe\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"file/memory contains long string with (Indicator: \"password\"; File: \"procdumpexe.exe\")\n file/memory contains long string with (Indicator: \"password\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"password\"; Source: \"00000000-00005084.00000000.105649.03380000.00000004.mdmp\")\n Found string \"tools may include personally identifiable or other sensitive information (such as usernames, passwords, paths to files accessed, and paz\" (Indicator: \"password\"; Source: \"00000000-00005084.00000000.105649.03380000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00005084.00000000.105649.03380000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"procdumpexe.exe\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry key/value (API string)","description":"Found reference to API \"RegDeleteKeyW\" (Indicator: \"RegDeleteKey\"; File: \"procdumpexe.exe\")\n Found reference to API \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\"; File: \"procdumpexe.exe\")\n Found reference to API \"RegDeleteKeyW\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp\")\n Found reference to API \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; File: \"procdumpexe.exe\")\n Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; File: \"procdumpexe.exe\")\n Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; File: \"procdumpexe.exe\")\n Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp\")\n Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp\")\n Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: procdumpexe.exe\n Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00005084.00000000.105649.009CA000.00000002.mdmp\n 00000000-00005084.00000000.105649.009EA000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"procdumpexe.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00005084.00000000.105649.009CA000.00000002.mdmp, 00000000-00005084.00000000.105649.009EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"procdumpexe.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CONHOST.EXE\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"procdumpexe.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"procdumpexe.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleW@KERNEL32.dll at 5186-3098-00408BD0\n GetModuleHandleW@KERNEL32.dll at 5186-3084-0040A130\n GetModuleHandleW@KERNEL32.dll at 5186-3225-00405880\n GetModuleHandleW@KERNEL32.dll at 5186-3081-0040A2B0\n GetModuleHandleW@KERNEL32.dll at 5186-3065-0040A090\n GetModuleHandleW@KERNEL32.dll at 5186-3192-004017E0\n GetModuleHandleW@KERNEL32.dll at 5186-3068-00411730","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system","description":"GetSystemInfo@KERNEL32.dll at 5186-3056-004128C0\n GetSystemInfo@KERNEL32.dll at 5186-3079-0040ABB0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"procdumpexe.exe\" reads file \"C:\\Windows\\win.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - Sysinternal Tool","description":"YARA signature for Sysinternal tool file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1573","relevance":2,"id":"yara-123","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the command-line string for the current process","description":"GetCommandLineW@KERNEL32.dll at 5186-3092-00408D60\n GetCommandLineW@KERNEL32.dll at 5186-1-004171E7\n GetCommandLineW@KERNEL32.dll at 5186-3072-0040B2D0\n GetCommandLineW@KERNEL32.dll at 5186-3066-00411410\n GetCommandLineW@KERNEL32.dll at 5186-3099-00407620","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-118","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module","description":"GetModuleFileNameW@KERNEL32.dll at 5186-3092-00408D60\n GetModuleFileNameW@KERNEL32.dll at 5186-3099-00407620","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-131","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Read windows product name from registry","description":"\"procdumpexe.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"PRODUCTNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-105","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"PE file contains executable resources","description":"procdumpexe.exe has PE file in resource with name: \"BINRES\" and filetype:PE32+ executable (console) x86-64\n for MS Windows","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":10,"id":"static-97","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"\" wrote bytes \"711154027a3b5302ab8b02007f950200fc8c0200729602006cc805001ecd50027d265002\" to virtual address \"0x751D07E4\" (part of module \"USER32.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5aa51ccd7ca3e1249a3a4558"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":55,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":4,"files_deleted_count":0,"registry_keys_created_count":6,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":6,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["tag","malware","chir","expiro","floxif","hacktool","metasploit","meterpreter","mofksys","neshta","netwire","netwiredrc","parite","patched","rat","qhost","rozena","swrort","tiggre"],"sample_flags":["User Comment"],"sandbox_reports":[{"id":"66311869a8e1328dd80f075f","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"clean","submit_name":"procdumpexe.exe","analysis_start_time":"2024-04-30T16:12:26+00:00","indicators_count":{"informative":108,"suspicious":24,"malicious":2},"tags":["User Comment"],"is_in_unified_schema":true},{"id":"5d256ff30288387817e9d9d0","environment_id":200,"environment_description":"Android Static Analysis","state":"SUCCESS","verdict":"clean","submit_name":"procdump.exe","analysis_start_time":"2019-07-10T04:54:41+00:00","indicators_count":{"informative":4,"suspicious":2,"malicious":1},"tags":["User Comment"],"is_in_unified_schema":true},{"id":"5aa51ccd7ca3e1249a3a4558","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"clean","threat_score":44,"submit_name":"Procdump.zip","analysis_start_time":"2020-02-14T17:21:03+00:00","indicators_count":{"informative":10,"suspicious":11,"malicious":1},"tags":["User Comment"],"is_in_unified_schema":true},{"id":"5aa51c8bde71add1debff45d","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"clean","threat_score":39,"submit_name":"mysqlsqa.exe","analysis_start_time":"2020-02-14T17:22:02+00:00","indicators_count":{"informative":10,"suspicious":10,"malicious":1},"tags":["User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5aa51c8bde71add1debff45d"}],"processes":[{"pid":388,"ppid":0,"name":"Procdump.zip.exe","command_line":"","sha256":"05732e84de58a3cc142535431b3aa04efbe034cc96e837f93c360a6387d8faad","normalized_path":"C:\\Procdump.zip.exe","uid":"00012086-00000388","icon":"$3b"}],"all_imported_dlls":["ole32.dll","uxtheme.dll","gdi32.dll","cryptbase.dll","lpk.dll","usp10.dll","advapi32.dll","ntdll.dll","KernelBase.dll","psapi.dll","msctf.dll","riched32.dll","dwmapi.dll","comdlg32.dll","kernel32.dll","rpcrt4.dll","oleaut32.dll","rpcss.dll","sechost.dll","shell32.dll","imm32.dll","riched20.dll","comctl32.dll","version.dll","clbcatq.dll","msvcrt.dll","shlwapi.dll","user32.dll","pdh.dll","TextInputFramework.dll","CoreMessaging.dll","cfgmgr32.dll","wow64.dll","apphelp.dll","powrprof.dll","wow64win.dll","win32u.dll","fltLib.dll","combase.dll","ucrtbase.dll","ws2_32.dll","ntmarta.dll","sspicli.dll","bcryptprimitives.dll","kernel.appcore.dll","VxSSL32.dll","WinTypes.dll","gdi32full.dll","profapi.dll","wow64cpu.dll","SHCore.dll","windows.storage.dll","msls31.dll","CoreUIComponents.dll","msvcp_win.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5aa51c8bde71add1debff45d"},{"report_type":"sandbox","report_id":"5aa51ccd7ca3e1249a3a4558"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5aa51c8bde71add1debff45d"},{"report_type":"sandbox","report_id":"5aa51ccd7ca3e1249a3a4558"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5aa51c8bde71add1debff45d"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5aa51ccd7ca3e1249a3a4558"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\SYSINTERNALS\\PROCDUMP\\","sources":[{"report_type":"sandbox","report_id":"5aa51c8bde71add1debff45d"},{"report_type":"sandbox","report_id":"5aa51ccd7ca3e1249a3a4558"}]},{"key":"HKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"5aa51c8bde71add1debff45d"},{"report_type":"sandbox","report_id":"5aa51ccd7ca3e1249a3a4558"}]},{"key":"HKCU\\SOFTWARE\\SYSINTERNALS\\","sources":[{"report_type":"sandbox","report_id":"5aa51c8bde71add1debff45d"},{"report_type":"sandbox","report_id":"5aa51ccd7ca3e1249a3a4558"}]},{"key":"HKCUHKCU\\SOFTWARE\\SYSINTERNALS\\PROCDUMP\\","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"key":"HKCUHKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"key":"HKCUHKCU\\SOFTWARE\\SYSINTERNALS\\","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"Local\\SM0:5084:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]},{"name":"SM0:5084:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"66311869a8e1328dd80f075f"}]}]}},"report_ids":{"sandbox_job_ids":["5aa51ccd7ca3e1249a3a4558","5aa51c8bde71add1debff45d","66311869a8e1328dd80f075f","5d256ff30288387817e9d9d0"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Clean Sample 05732e84de58… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Clean verdict for sample 05732e84de58…. Threat score 0/100. 0/24 AV engines flagged this file. 2 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/05732e84de58a3cc142535431b3aa04efbe034cc96e837f93c360a6387d8faad"}],["$","meta","4",{"property":"og:title","content":"Clean Sample 05732e84de58… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Clean verdict for sample 05732e84de58…. Threat score 0/100. 0/24 AV engines flagged this file. 2 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/05732e84de58a3cc142535431b3aa04efbe034cc96e837f93c360a6387d8faad"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Clean Sample 05732e84de58… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Clean verdict for sample 05732e84de58…. Threat score 0/100. 0/24 AV engines flagged this file. 2 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3c","11",{}]]