34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 4f:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T502,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_90% Sample 1b097fb7b968… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 1b097fb7b968…. Malware family: Win/malicious_confidence_90%. Threat score 100/100. 12/25 AV engines flagged this file. 5 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/1b097fb7b968facb017598df033ffd2c477f84f713a3035fade2667dee14fda2","keywords":["Malicious","Win/malicious_confidence_90%","malware analysis","sandbox report","threat intelligence","1b097fb7b968facb017598df033ffd2c477f84f713a3035fade2667dee14fda2"],"about":{"@type":"SoftwareApplication","name":"1b097fb7b968facb017598df033ffd2c477f84f713a3035fade2667dee14fda2.bin","applicationCategory":["peexe","assembly","executable"],"identifier":"1b097fb7b968facb017598df033ffd2c477f84f713a3035fade2667dee14fda2","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_90%","antivirusDetections":{"malicious":12,"total":25},"behavioralIndicators":{"malicious":5,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T92e,Found reference to API "System.Runtime.InteropServices" (Indicator: "time"; Source: "sample.bin"), Found reference to API "set_downloadLink" (Indicator: "link"; Source: "sample.bin"), Found reference to API "ReadAllLines" (Indicator: "read"; Source: "sample.bin"), Found reference to API "CreateEncryptor" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "CreateEncryptor" (Indicator: "tee"; Source: "sample.bin"), Found reference to API "SetComplexity" (Indicator: "exit"; Source: "sample.bin"), Found reference to API "Core.ByteEncryption" (Indicator: "tee"; Source: "sample.bin"), Found reference to API "GetComplexity" (Indicator: "exit"; Source: "sample.bin"), Found reference to API "Thread::Start" (Indicator: "read"; Source: "sample.bin"), Found reference to API "CreateParamDef" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "ReadString" (Indicator: "read"; Source: "sample.bin"), Found reference to API "set_ReadOnly" (Indicator: "read"; Source: "sample.bin"), Found reference to API "SplitStatements" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "set_CreateNoWindow" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "CreateSections" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "AntiDumpRuntime" (Indicator: "time"; Source: "sample.bin"), Found reference to API "get_TabButtonSelectedState" (Indicator: "select"; Source: "sample.bin"), Found reference to API "get_TabButtonSelectedState" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "Access-Control-Allow-Methods" (Indicator: "access"; Source: "sample.bin"), Found reference to API "ReadExistingAssembly" (Indicator: "read"; Source: "sample.bin"), Found reference to API "SendAsync" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "HttpListenerContext" (Indicator: "listen"; Source: "sample.bin"), Found reference to API "get_UncheckedState" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "SecuritySafeCriticalAttribute" (Indicator: "security"; Source: "sample.bin"), Found reference to API "JITRuntime" (Indicator: "time"; Source: "sample.bin"), Found reference to API "RuntimeMethodHandle" (Indicator: "time"; Source: "sample.bin"), Found reference to API "api-ms-win-core-xstate-l2-1-0" (Indicator: "stat"; Source: "sample.bin")37:T7a0,Found reference to API (Indicator: "MessageBox"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectory"; Source: "sample.bin"), Found reference to API (Indicator: "ResumeThread"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPath"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseCapture"; Source: "sample.bin"), Found reference to API (Indicator: "FindWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributes"; Source: "sample.bin"), Found reference to API (Indicator: "GetTokenInformation"; Source: "sample.bin"), Found reference to API (Indicator: "SendMessage"; Source: "sample.bin"), Found reference to API (Indicator: "SuspendThread"; Source: "sample.bin"), Found reference to API (Indicator: "CallWindowProc"; Source: "sample.bin"), Found reference to API (Indicator: "OpenThread"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentDirectory"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandle"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualProtect"; Source: "sample.bin"), Found reference to API (Indicator: "GetObject"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessById"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin")38:T5de,Found string "CreateEncryptor" (Indicator: "createencryptor"; Source: "sample.bin"), Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; Source: "sample.bin"), Found string "ToBase64String" (Indicator: "base64"; Source: "sample.bin"), Found string "ToBase64String" (Indicator: "ToBase64String"; Source: "sample.bin"), Found string "RNGCryptoServiceProvider" (Indicator: "rngcryptoserviceprovider"; Source: "sample.bin"), Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; Source: "sample.bin"), Found string "QuickLZ" (Indicator: "quicklz"; Source: "sample.bin"), Found string "RNGCryptoServiceProviderRandom" (Indicator: "rngcryptoserviceprovider"; Source: "sample.bin"), Found string "CryptoStreamMode" (Indicator: "cryptostream"; Source: "sample.bin"), Found string "CryptoStreamMode" (Indicator: "cryptostreammode"; Source: "sample.bin"), Found string "Rijndael" (Indicator: "rijndael"; Source: "sample.bin"), Found string "toBase64" (Indicator: "base64"; Source: "sample.bin"), Found string "CryptoStream" (Indicator: "cryptostream"; Source: "sample.bin"), Found string "CreateDecryptor" (Indicator: "createdecryptor"; Source: "sample.bin"), Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; Source: "sample.bin"), Found string "FromBase64String" (Indicator: "base64"; Source: "sample.bin"), Found string "FromBase64String" (Indicator: "FromBase64String"; Source: "sample.bin")39:T4f4,Found reference to "SHA256Managed" (Indicator: "SHA256Managed"; Source: "sample.bin"), Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "sample.bin"), Found reference to "SHA1Managed" (Indicator: "SHA1Managed"; Source: "sample.bin"), Found reference to "RNGCryptoServiceProvider" (Indicator: "RNGCryptoServiceProvider"; Source: "sample.bin"), Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "sample.bin"), Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "sample.bin"), Found reference to "RNGCryptoServiceProviderRandom" (Indicator: "RNGCryptoServiceProvider"; Source: "sample.bin"), Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "sample.bin"), Found reference to "Rijndael" (Indicator: "Rijndael"; Source: "sample.bin"), Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "sample.bin"), Found reference to "HMACSHA256" (Indicator: "HMAC"; Source: "sample.bin"), Found reference to "HMACSHA256" (Indicator: "HMACSHA256"; Source: "sample.bin"), Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "sample.bin"), Found reference to "HashHMAC" (Indicator: "HMAC"; Source: "sample.bin")3a:T668,Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "1b097fb7b968facb017598df033ffd2c477f84f713a3035fade2667dee14fda2.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "1b097fb7b968facb017598df033ffd2c477f84f713a3035fade2667dee14fda2.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Copy" in "1b097fb7b968facb017598df033ffd2c477f84f713a3035fade2667dee14fda2.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetHINSTANCE" in "1b097fb7b968facb017598df033ffd2c477f84f713a3035fade2667dee14fda2.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "1b097fb7b968facb017598df033ffd2c477f84f713a3035fade2667dee14fda2.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "1b097fb7b968facb017598df033ffd2c477f84f713a3035fade2667dee14fda2.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadInt32" in "1b097fb7b968facb017598df033ffd2c477f84f713a3035fade2667dee14fda2.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "1b097fb7b968facb017598df033ffd2c477f84f713a3035fade2667dee14fda2.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StringToHGlobalAnsi" in "1b097fb7b968facb017598df033ffd2c477f84f713a3035fade2667dee14fda2.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetDelegateForFunctionPointer" in "1b097fb7b968facb017598df033ffd2c477f84f713a3035fade2667dee14fda2.bin"3b:T589,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to decode base64 data Matched sigs: Able to decrypt/decode data Matched sigs: Contains reference to crypto DLLs Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Contains reference to cryptographic keys Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Reads the cryptographic machine GUID Matched sigs: Contains ability to perform crypto operations Matched sigs: Able to decode string content at runtime (.NET) Matched sigs: Contains ability to perform symmetric crypto operations Matched sigs: Contains ability to perform AES cryptographic operations (Dotnet) Matched sigs: Contains ability to perform symmetric encryption (Dotnet) Matched sigs: Dotnet file contains encryption/decryption functions Matched sigs: Contains symmetric decryption functionality in .NET code Matched sigs: Contains ability to perform CryptoStream operations (Dotnet) Matched sigs: Sample file has high entropy (likely encrypted/compressed content)3c:Tc110,Found XOR loop in file "sample.bin" at offset 1346497; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1347964; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1350361; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1371525; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1387433; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1392494; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1393266; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1396827; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1464218; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1471315; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1668839; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1707017; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1708628; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1737557; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1753515; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1755646; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1762193; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1766859; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1768075; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1777037; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1777285; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1781226; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1794187; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1794348; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1794476; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1804982; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1805267; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1806803; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1807905; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1828058; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1852271; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1883133; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1901701; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1931075; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1932856; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1934770; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1938858; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1942106; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1961156; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2077809; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2079092; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2138283; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2141408; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2181460; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2182540; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2183575; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2185006; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2185491; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2188142; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2193946; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2194432; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2199462; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2209546; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2211476; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2211970; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2213885; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2214639; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2227602; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2229298; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2231503; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2254313; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2256133; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2262863; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2266145; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2266759; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2277931; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2283399; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2408908; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2415897; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2423297; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2445672; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2528179; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2533314; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2565142; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2593834; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2618938; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2657909; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2658401; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2672836; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2673239; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2689349; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2694982; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2695580; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2696338; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2696695; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2700239; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2706881; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2761098; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2771511; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2774005; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2775864; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2780175; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2792892; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2797726; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2806671; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2811170; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2812590; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2815572; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2820177; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2820541; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2874560; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2879122; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2886728; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2910729; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2938747; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2974082; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2988727; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3046282; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3093889; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3094134; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3094980; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3103047; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3107298; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3109654; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3124235; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3124240; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3128076; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3147317; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3161946; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3208316; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3213039; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3224123; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3227598; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3228745; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3264991; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3272585; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3273010; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3283749; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3295696; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3320914; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3367827; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3415435; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3489279; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3531386; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3543768; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3553726; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3600557; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3608530; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3613205; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3620214; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3657078; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3785518; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3908440; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3913057; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3917115; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3948040; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3955310; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4063762; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4111320; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4115281; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4118881; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4120153; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4124706; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4347065; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4348155; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4361261; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4403697; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4405666; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4428868; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4430439; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4433013; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4434456; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4445054; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4447423; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4526907; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4654805; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4772596; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4791421; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4808250; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4811423; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4814368; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4815503; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4815982; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4816001; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4862557; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4875417; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4879048; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4879053; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4880005; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4880042; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4885033; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4903286; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4905189; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4911217; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4914921; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4935184; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4936262; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4938264; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4944728; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4948777; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4956427; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4980714; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4981438; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5000136; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5021133; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5023938; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5024870; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5032691; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5033181; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5035364; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5061853; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5152672; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5175145; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5299450; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5329764; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5398199; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5399031; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5406776; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5416513; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5418595; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5419022; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5431103; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5433519; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5434745; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5442086; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5462255; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5530430; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5547691; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5555007; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5574066; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5596933; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5655483; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5740672; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5849691; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5876306; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5879992; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5891002; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5896864; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5908099; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5922819; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5922915; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5947128; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5947328; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5963718; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6056811; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6067383; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6069325; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6075843; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6077570; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6141047; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6191258; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6242322; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6249734; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6325852; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6336424; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6338366; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6344884; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6346611; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6410088; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6460299; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6511363; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6518775; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6542911; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6543899; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6544728; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6559098; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6577612; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6637262; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6656646; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6735853; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6791460; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6822426; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6848641; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6850432; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6855807; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6864766; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6889280; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6905339; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6913014; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6942598; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7279312; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7317548; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7317940; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7323862; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7342960; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7343827; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7351453; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7361215; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7363977; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7368406; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7385965; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7385970; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7386172; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7387286; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7390524; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7392237; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7394871; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7396738; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7397938; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7405935; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7407597; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7489121; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7490903; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7493407; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7520041; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7526733; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7538102; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7541905; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7554829; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7558410; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7558630; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7558880; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7699873; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7700107; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7704066; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7712488; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7714654; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7763145; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7793545; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7804771; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7808142; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7821392; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7824456; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7900139; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7900227; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7924181; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8044197; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8054270; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8132287; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8142954; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8142994; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8144891; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8165417; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8166748; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8172039; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8174917; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8175302; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8175540; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8177320; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8180780; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8187256; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8188902; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8189343; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8189744; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8190615; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8192195; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8192898; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8199675; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8206987; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8210236; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8210561; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8212069; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8220553; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8235993; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8236331; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8251391; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8251822; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8253971; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8254261; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8254563; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8318100; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8406097; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8408188; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8428137; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8429284; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8446666; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8463951; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8466910; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8479850; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8479867; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8481634; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8481745; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8483151; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8513012; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8530126; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8719752; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8759708; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8762287; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8797792; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8804318; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8967032; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8979623; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9008718; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9024495; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9075274; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9127850; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9215887; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9256469; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9278350; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9289898; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9316453; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1342169; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1393919; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1680966; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2052498; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2293654; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2991062; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3083424; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3122194; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3186285; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3650070; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3704057; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3870510; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3880404; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4210076; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4217420; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4283538; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4550953; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4692640; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4874506; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5021767; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5101784; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5116443; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5163213; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5204391; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5352384; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5537454; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5611406; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5635334; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5964812; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6187855; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6456896; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6688256; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6856049; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7079345; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7194334; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7195795; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7447260; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7555066; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7615072; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7833853; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7850963; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8245116; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8248380; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8379284; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8380477; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8518955; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8548299; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8654739; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8698429; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8725781; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8741453; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8864071; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8913045; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9114230; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9233732; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 205068; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 205076; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 227628; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 833353; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 833713; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 879140; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1314650; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1315010; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1374498; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1389947; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1531401; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1531960; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1553855; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1557126; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1558457; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1570562; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1583079; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1588692; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1595285; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1600061; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1614882; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1621519; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1688268; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1707495; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1710345; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1770488; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1783914; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1785377; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1887520; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1908560; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2048662; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2133557; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2174846; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2331726; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2424701; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2427390; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2435665; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2435675; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2458629; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2465273; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2467630; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2469334; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2551994; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2552219; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2553035; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2576041; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2576260; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2630308; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2661083; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2676070; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2687986; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2706126; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2785443; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2832858; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2840676; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2857371; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2867549; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2913960; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2927715; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2957156; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2965836; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2976293; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2985225; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3020270; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3119780; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3164538; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3219817; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3310464; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3311360; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3429067; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3509598; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3517074; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3554405; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3621649; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3648083; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3651383; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3696479; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3740008; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3742229; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3762712; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3880748; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3932405; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3977474; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4064937; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4070131; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4118157; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4120553; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4131669; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4169639; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4174467; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4177905; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4184337; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4187619; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4207751; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4229170; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4238414; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4244145; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4246661; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4247729; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4301902; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4422430; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4502058; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4513838; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4520603; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4536175; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4570904; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4583965; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4587885; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4594171; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4612083; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4682357; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4807933; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4870517; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4872242; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4893253; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4956870; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4970676; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5039607; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5060922; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5111527; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5249889; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5272759; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5313026; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5329598; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5343865; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5349012; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5353560; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5354515; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5362226; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5418594; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5438011; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5458885; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5538224; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5576075; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5586294; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5599679; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5905844; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5909934; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5943402; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5986724; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6025924; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6026484; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6129661; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6188263; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6243317; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6294965; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6295525; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6398702; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6457304; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6512358; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6549358; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6623515; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6706923; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6750531; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6804351; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6806622; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6831611; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6835896; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6939432; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6948137; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6993898; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7000381; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7003307; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7005025; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7014925; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7016537; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7019281; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7028513; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7029450; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7031122; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7032320; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7035403; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7050677; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7055091; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7056449; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7142653; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7260238; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7260298; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7302788; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7322838; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7397010; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7437652; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7437694; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7454713; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7469213; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7485552; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7489736; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7514978; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7527908; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7533330; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7545570; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7560903; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7752046; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7779013; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7869150; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7951882; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8131894; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8151470; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8161429; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8166675; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8178324; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8179161; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8207300; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8259381; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8318395; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8327773; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8375998; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8409531; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8412016; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8472606; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8483752; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8484924; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8514873; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8527134; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8682286; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8703354; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8763426; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8766940; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8769059; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8791507; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8916300; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8932094; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9035910; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9103716; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9110322; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9156070; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9161299; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9169284; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9193295; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9376640; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9391225; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9442461; code bytes = 80303d:Tc6f,"(System.Collections.Generic.IDictionary`2>,System.UInt32,dnlib.DotNet.Emit.Instruction) at 3e9617df32c2abb8331f0ecfce7721c6-600047f-ctor Helpers.MethodBlocks.BlockUtils::AddListEntry(System.Collections.Generic.IDictionary`2>,System.UInt32,dnlib.DotNet.Emit.Instruction) at 3e9617df32c2abb8331f0ecfce7721c6-600016f-ctor System.Reflection.Module::GetMethods(System.Reflection.BindingFlags) at 3e9617df32c2abb8331f0ecfce7721c6-60002a9-JITRuntime~Initialize System.Windows.Forms.PictureBox::set_TabIndex(System.Int32) at 3e9617df32c2abb8331f0ecfce7721c6-6000313-customMessage~InitializeComponent System.Windows.Forms.Control::set_TabIndex(System.Int32) at 3e9617df32c2abb8331f0ecfce7721c6-6000357-GUI~InitializeComponent System.Windows.Forms.Control::set_TabIndex(System.Int32) at 3e9617df32c2abb8331f0ecfce7721c6-6000366-Login~InitializeComponent System.Net.HttpListener::get_Prefixes() at 3e9617df32c2abb8331f0ecfce7721c6-60003d5-api~button4d:T460,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAADDklEQVR4Xq1TW0tUURidPxKFXRxLCyMnL+lkozaRmVQiljmT4Q3NhwoqUg6UoGJ5IYuQHoropSLMkB6kVKIrPfTQ/1ntb/bec76zzz4XqwWL833fWt86e88lkdgitueAbSMWDgOmNzZKhgBNU+PQnh2Gr2TQ3Y+bUfQlB4Bkv2x4zVEmZqSVWjQThYwBu49ryT5VV/S55nJR856wv9c/iwL5bTs028fmBc/BXndQmQeo5zNZ+8OiYMuxzRLV4qWH83JIdXWPID01c1JLXQBSeUkdwEEZpNUwnfazV9ysKpWtNV0n6oWg2dEhh3WqN/X6bvk8og7m0ZWm9xry7pz6dI7lKE8RzcLU2AVkxE0z5+23DEIt+1gJTeoSXMvobME0063ICnNLp980+ck/iwPKI5rzQLSJl2eNU05vAsTJ9eAg7XEMD+XxPhJnz/kX7m8AmqZGcH67+sxHr4fybJlWdLYDnWf85nviZgshtycsfADmrR6gy5JpRU97PONF4etuEzwNxNmJ40nQSS+fCjf2tUpPgScVVW96OS4JX2+EJzEkTEMn7CbSzJkNtD9o8ebSItsy92BULA9nvKbR47InbTQLjAQcsKALLz37W90d08N7H663eA3UX22WM0fcgHrOa81S98xYhswz+xDcanINVPPexA2lE8ca7b4xpd9UOVQ7jt1bgHPMFXn9Lxg/CoyrLMq8HXDYAibSrmjWdxtCFhnoqyL/RL30U32H1XpuxTQTzXqrLO7WAVOqp/lUXcgB5mqDRdK0/qAKmBVBc4Lz9FTzWeWZUT9cE2H5BSxWA0RzrrGYkjrxUY30OeJX/lDNwnYJUXpiQfzPl1IRJoHHVdJn0vRxLKkdc+7D00PAk6iP6i9AuebMimfipC8qw83fV4FvKy6/Lof7n1dGZ3rw6gBANOeEn2+BIP5Y8e+8rAjOCsVyOfCm3Lv4S9w0igTtf10GUA7P2BJW9wJEcx4H7/5h14O1PcBaUtLUbHivvHH9sbGxGyhylzd8cyewzvT10v/8co7P4mVfAmh64+APOF+yl7QyFA0AAAAASUVORK5CYII=4e:T460,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAADDklEQVR4Xq1TW0tUURidPxKFXRxLCyMnL+lkozaRmVQiljmT4Q3NhwoqUg6UoGJ5IYuQHoropSLMkB6kVKIrPfTQ/1ntb/bec76zzz4XqwWL833fWt86e88lkdgitueAbSMWDgOmNzZKhgBNU+PQnh2Gr2TQ3Y+bUfQlB4Bkv2x4zVEmZqSVWjQThYwBu49ryT5VV/S55nJR856wv9c/iwL5bTs028fmBc/BXndQmQeo5zNZ+8OiYMuxzRLV4qWH83JIdXWPID01c1JLXQBSeUkdwEEZpNUwnfazV9ysKpWtNV0n6oWg2dEhh3WqN/X6bvk8og7m0ZWm9xry7pz6dI7lKE8RzcLU2AVkxE0z5+23DEIt+1gJTeoSXMvobME0063ICnNLp980+ck/iwPKI5rzQLSJl2eNU05vAsTJ9eAg7XEMD+XxPhJnz/kX7m8AmqZGcH67+sxHr4fybJlWdLYDnWf85nviZgshtycsfADmrR6gy5JpRU97PONF4etuEzwNxNmJ40nQSS+fCjf2tUpPgScVVW96OS4JX2+EJzEkTEMn7CbSzJkNtD9o8ebSItsy92BULA9nvKbR47InbTQLjAQcsKALLz37W90d08N7H663eA3UX22WM0fcgHrOa81S98xYhswz+xDcanINVPPexA2lE8ca7b4xpd9UOVQ7jt1bgHPMFXn9Lxg/CoyrLMq8HXDYAibSrmjWdxtCFhnoqyL/RL30U32H1XpuxTQTzXqrLO7WAVOqp/lUXcgB5mqDRdK0/qAKmBVBc4Lz9FTzWeWZUT9cE2H5BSxWA0RzrrGYkjrxUY30OeJX/lDNwnYJUXpiQfzPl1IRJoHHVdJn0vRxLKkdc+7D00PAk6iP6i9AuebMimfipC8qw83fV4FvKy6/Lof7n1dGZ3rw6gBANOeEn2+BIP5Y8e+8rAjOCsVyOfCm3Lv4S9w0igTtf10GUA7P2BJW9wJEcx4H7/5h14O1PcBaUtLUbHivvHH9sbGxGyhylzd8cyewzvT10v/8co7P4mVfAmh64+APOF+yl7QyFA0AAAAASUVORK5CYII=30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"1b097fb7b968facb017598df033ffd2c477f84f713a3035fade2667dee14fda2","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1794318082776,"unified_at":"2026-11-10T13:41:22.776Z","metadata":{"hashes":{"sha256":"1b097fb7b968facb017598df033ffd2c477f84f713a3035fade2667dee14fda2","sha1":"3253418c617de14ea99bfeab571de684e5cff084","md5":"3e9617df32c2abb8331f0ecfce7721c6","sha512":"cac8e9502d6efec497474f27f3761c560add1bad70123c41264e02188aac046a77d5cc9ce0957712ec5f708f41667b810912cdefc5e599f43ddfee4ec5b1ee11","ssdeep":"196608:EZwy+lpgtI0FIQ7uMtG4T47mM/zuIdw0dbdbb:EOlv0B7BtDkiMCabd","ssdeep_chunks":["196608:EZwy+lp","196608:Zwy+lpg","196608:wy+lpgt","196608:y+lpgtI","196608:+lpgtI0","196608:lpgtI0F","196608:pgtI0FI","196608:gtI0FIQ","196608:tI0FIQ7","196608:I0FIQ7u","196608:0FIQ7uM","196608:FIQ7uMt","196608:IQ7uMtG","196608:Q7uMtG4","196608:7uMtG4T","196608:uMtG4T4","196608:MtG4T47","196608:tG4T47m","196608:G4T47mM","196608:4T47mM/","196608:T47mM/z","196608:47mM/zu","196608:7mM/zuI","196608:mM/zuId","196608:M/zuIdw","196608:/zuIdw0","196608:zuIdw0d","196608:uIdw0db","196608:Idw0dbd","196608:dw0dbdb","196608:w0dbdbb","393216:EZwy+lp","393216:Zwy+lpg","393216:wy+lpgt","393216:y+lpgtI","393216:+lpgtI0","393216:lpgtI0F","393216:pgtI0FI","393216:gtI0FIQ","393216:tI0FIQ7","393216:I0FIQ7u","393216:0FIQ7uM","393216:FIQ7uMt","393216:IQ7uMtG","393216:Q7uMtG4","393216:7uMtG4T","393216:uMtG4T4","393216:MtG4T47","393216:tG4T47m","393216:G4T47mM","393216:4T47mM/","393216:T47mM/z","393216:47mM/zu","393216:7mM/zuI","393216:mM/zuId","393216:M/zuIdw","393216:/zuIdw0","393216:zuIdw0d","393216:uIdw0db","393216:Idw0dbd","393216:dw0dbdb","393216:w0dbdbb","196608:EOlv0B7","196608:Olv0B7B","196608:lv0B7Bt","196608:v0B7BtD","196608:0B7BtDk","196608:B7BtDki","196608:7BtDkiM","196608:BtDkiMC","196608:tDkiMCa","196608:DkiMCab","196608:kiMCabd"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"1b097fb7b968facb017598df033ffd2c477f84f713a3035fade2667dee14fda2.bin","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":9456640,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1782199493000,"last_seen":1794317960000,"last_multi_scan":1794317960000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["evasive"]},"stats":{"av":{"malicious_count":12,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":2,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":60},"sandbox_signatures":{"informative_count":156,"suspicious_count":16,"malicious_count":5,"total":177},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/MSIL.AntiVM","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"DR/W32.MalwareX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"IL:Application.GenericFCA.2317","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Agent.XID trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.sa","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/MSIL.Obfuscated.kp","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005ce4471 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"high_entropy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Agent.IJH.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.Win32.4611537","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_90%","sources":[{"report_type":"quickscan","report_id":""}]},{"value":"Trojan.Agent","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Stealth","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"tactic":"Stealth","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Contains a Wine emulator-related string"},{"type":"informative","value":"Able to identify virtual/sandbox environment"},{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to gather system information (Dotnet)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Able to gather system file/directory information (.NET)"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"YARA signature match - Queries video controller using WMI"},{"type":"informative","value":"Contains ability to execute a WMI query"},{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"informative","value":"Contains ability to execute WMI queries (Dotnet)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"tactic":"Privilege Escalation","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains symmetric decryption functionality in .NET code"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Able to decode string content at runtime (.NET)"},{"type":"informative","value":"Able to load content into memory (.NET)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"tactic":"Stealth","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Contains ability to generate intermediate language instructions (Dotnet)"},{"type":"informative","value":"Dotnet code contains potential unpacker"},{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"},{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk services using registry"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"suspicious","value":"Contains ability to enumerate processes/modules/threads"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Contains ability to gather process details (Dotnet)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Queries basic information of the specified process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Able to detect if debugger is present"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"},{"type":"informative","value":"Able to perform SQL operations"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"tactic":"Stealth","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Able to identify virtual environment using sandbox registry"},{"type":"informative","value":"Able to detect virtual machine (string)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"The input sample contains the RDTSCP instruction"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":".NET code is able to query registry"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Able to execute application (.NET)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains native function calls (syscalls strings)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":".NET source code contains suspicious native API"},{"type":"informative","value":"Contains ability to start a process (Dotnet)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Dotnet code contains ability to generate random numbers"},{"type":"informative","value":"Contains ability to perform AES cryptographic operations (Dotnet)"},{"type":"informative","value":"Contains ability to perform symmetric encryption (Dotnet)"},{"type":"informative","value":"Dotnet file contains encryption/decryption functions"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to perform crypto operations"},{"type":"informative","value":"Contains ability to load content from resource"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Contains ability to load manifest resource from assembly (Dotnet)"},{"type":"informative","value":"Contains ability to perform CryptoStream operations (Dotnet)"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Dotnet file resource with suspicious entropy"},{"type":"informative","value":"YARA signature match – high entropy image embedded in .NET resource"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"suspicious","value":"Reference to an external IP address lookup service identified"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Queries the user identity associated with the current process token"},{"type":"informative","value":"Contains ability to retrieve current user details (Dotnet)"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"informative","value":"Contains ability to provide interface for network protocols (Dotnet)"},{"type":"informative","value":"Contains ability to communicate with network (Dotnet)"},{"type":"informative","value":"Dotnet code contains ability to establish a HTTP listener"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"},{"type":"suspicious","value":"Able to capture screenshot"},{"type":"suspicious","value":"Able to perform a screen capture"},{"type":"informative","value":"Contains ability to capture screen information (Dotnet)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"tactic":"Stealth","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"tactic":"Stealth","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Able to execute applications in hidden mode (.NET)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"tactic":"Stealth","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"},{"type":"informative","value":"Spawns Windows crash diagnostic and reporting process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Dotnet code contains ability to modify/delete registry"}],"sources":[{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","identifiers":[{"type":"suspicious","value":"Contains ability to adjust token privileges"}],"sources":[{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"tactic":"Credential Access","technique":"Network Sniffing","attack_id":"T1040","attack_id_wiki":"https://attack.mitre.org/techniques/T1040","identifiers":[{"type":"suspicious","value":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Contains ability to upload data with network (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Able to download remote files (.NET)"},{"type":"informative","value":"Contains ability to download files with network (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Contains ability to perform symmetric crypto operations"}],"sources":[{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"suspicious","value":"Contains ability to open a port and listen for incoming connection"},{"type":"informative","value":"References server/domain address with port number"}],"sources":[{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","sources":[{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"tactic":"Stealth","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy resources"},{"type":"informative","value":"Dotnet file contains function to dynamically call methods at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"tactic":"Stealth","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","sources":[{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"tactic":"Stealth","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"},{"type":"informative","value":"YARA signature match – Embedded PE executable"}],"sources":[{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"tactic":"Stealth","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Able to read the PEB (Process Environment Block) structure"}],"sources":[{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"tactic":"Stealth","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"tactic":"Defense Impairment","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to set file attributes (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]}],"sandbox_signatures":[{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - Queries video controller using WMI","description":"YARA signature for WMI query for video controller matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1047","id":"yara-51","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with high confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-12","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with high confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-16","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains native function calls (syscalls strings)","description":"$36","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-5000","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Can load assembly that contains the code that is currently executing (Dotnet)","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1620","id":"string-615","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-240","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$37","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1074.001","id":"string-423","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"Found string \"https://www.paypal.com/paypalme/Inx707\" (Indicator: \"paypal\"; Source: \"sample.bin\"), Found string \"Paypal\" (Indicator: \"paypal\"; Source: \"sample.bin\"), Found string \"paypal_30px\" (Indicator: \"paypal\"; Source: \"sample.bin\"), Found string \"get_paypal_30px\" (Indicator: \"paypal\"; Source: \"sample.bin\"), Found string \"Application not setup correctly. Please watch the YouTube video for setup.\" (Indicator: \"youtube\"; Source: \"sample.bin\")","origin":"sample.bin","id":"string-10","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"https://www.paypal.com/paypalme/Inx707\" (Indicator: \"paypal.com\")","origin":"sample.bin","id":"string-135","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"sample.bin\"), Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; Source: \"sample.bin\"), Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-161","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"dnlib.DotNet.Pdb\"","origin":"sample.bin","id":"string-7","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"HARDWARE\\Description\\System\" in Source: sample.bin, \"SOFTWARE\\VMware, Inc.\\VMware Tools\" in Source: sample.bin, \"SOFTWARE\\Oracle\\VirtualBox Guest Additions\" in Source: sample.bin, \"Software\\SBAC\" in Source: sample.bin, \"SYSTEM\\ControlSet001\\Control\\Class\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000\\Settings\" in Source: sample.bin, \"SYSTEM\\ControlSet001\\Services\\Disk\\Enum\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"SELECT * FROM Win32_VideoController\" (Source: sample.bin, Indicator: \"select * from win32_videocontroller\")","origin":"sample.bin","mitre_attack_id":"T1213","id":"string-16","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-272","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$38","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"GetProcessesByName\" (Indicator: \"GetProcessesByName\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandle\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetProcessById\" (Indicator: \"GetProcessById\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetTempPath\" (Indicator: \"GetTempPath\"; Source: \"sample.bin\"), Found reference to API \"GetFileAttributes\" (Indicator: \"GetFileAttributes\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentDirectory\" (Indicator: \"GetCurrentDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"secret\" (Indicator: \"secret\"; Source: \"sample.bin\"), Found string \"password\" (Indicator: \"password\"; Source: \"sample.bin\"), Found string \"get_sign_in_form_password_20px\" (Indicator: \"password\"; Source: \"sample.bin\"), Found string \"sign_in_form_password_20px\" (Indicator: \"password\"; Source: \"sample.bin\"), Found string \"password_TextChanged\" (Indicator: \"password\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555","id":"string-475","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\"), Found reference to API \"GetProcAddress2\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\"), Found reference to API \"GetProcAddress_3\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\"), Found reference to API \"GetProcAddress_2\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-121","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"SELECT * FROM Win32_VideoController\" (Indicator: \" Win32_VideoController\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-507","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandle\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"CopyFromScreen\" (Indicator: \"CopyFromScreen\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1113","id":"string-78","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to detect virtual machine (string)","description":"Found string \"C:\\WINDOWS\\system32\\drivers\\vmhgfs.sys\" (Source: \"sample.bin\"), Found string \"C:\\WINDOWS\\system32\\drivers\\vmmouse.sys\" (Source: \"sample.bin\"), Found string \"SOFTWARE\\Oracle\\VirtualBox Guest Additions\" (Source: \"sample.bin\"), Found string \"C:\\PROGRAM FILES\\VMWARE\\VMWARE TOOLS\\\" (Source: \"sample.bin\"), Found string \"C:\\WINDOWS\\system32\\drivers\\VBoxMouse.sys\" (Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497","id":"string-989","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual/sandbox environment","description":"Found string \"C:\\WINDOWS\\system32\\drivers\\vmhgfs.sys\" (Indicator: \"vmhgfs\"; Source: \"sample.bin\"), Found string \"C:\\WINDOWS\\system32\\drivers\\vmmouse.sys\" (Indicator: \"vmmouse\"; Source: \"sample.bin\"), Found string \"C:\\WINDOWS\\system32\\drivers\\VBoxMouse.sys\" (Indicator: \"VBoxMouse\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.001","id":"string-660","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"Found string \"https://www.paypal.com/paypalme/Inx707\" (Indicator: \"paypal.com\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1590","id":"string-761","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"FindWindow\" (Indicator: \"findwindow\"; Source: \"sample.bin\"), Found reference to API \"SendMessage\" (Indicator: \"sendmessage\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.015","id":"string-721","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"FindWindow\" (Indicator: \"FindWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-141","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"Set Default API\" (Indicator: \"set \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-326","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"SELECT * FROM Win32_VideoController\" (Indicator: \" win32_videocontroller\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1047","id":"string-55","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"SELECT * FROM Win32_VideoController\" (Indicator: \"select * from \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1047","id":"string-433","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using sandbox registry","description":"Found string \"SOFTWARE\\VMware, Inc.\\VMware Tools\" (Indicator: \"software\\vmware, inc.\\vmware tools\"; Source: \"sample.bin\"), Found string \"SOFTWARE\\Oracle\\VirtualBox Guest Additions\" (Indicator: \"software\\oracle\\virtualbox guest additions\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497","id":"string-668","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk services using registry","description":"Found string \"SYSTEM\\ControlSet001\\Services\\Disk\\Enum\" (Indicator: \"system\\controlset001\\services\\disk\\enum\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1680","id":"string-999","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains a Wine emulator-related string","description":"\"wine_get_unix_file_name\" (Indicator: \"wine_get_unix_file_name\")","origin":"sample.bin","mitre_attack_id":"T1497.001","id":"string-62","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"C:\\WINDOWS\\system32\\drivers\\vmhgfs.sys\" (Indicator: \"\\drivers\\\"; Source: \"sample.bin\"), Found string \"C:\\WINDOWS\\system32\\drivers\\vmhgfs.sys\" (Indicator: \"system32\\drivers\"; Source: \"sample.bin\"), Found string \"C:\\WINDOWS\\system32\\drivers\\vmmouse.sys\" (Indicator: \"\\drivers\\\"; Source: \"sample.bin\"), Found string \"C:\\WINDOWS\\system32\\drivers\\vmmouse.sys\" (Indicator: \"system32\\drivers\"; Source: \"sample.bin\"), Found string \"C:\\WINDOWS\\system32\\drivers\\VBoxMouse.sys\" (Indicator: \"\\drivers\\\"; Source: \"sample.bin\"), Found string \"C:\\WINDOWS\\system32\\drivers\\VBoxMouse.sys\" (Indicator: \"system32\\drivers\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-474","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-114","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$39","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-138","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"sample.bin\"), Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; Source: \"sample.bin\"), Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.003","id":"string-309","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\ROOT\\cimv2; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564","id":"string-145","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProc\" (Indicator: \"CallWindowProc\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-320","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-306","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"18.0.0.0\", \"1.1.0.0\", Potential IP \"17.14.0.0\" found in string \"KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator\t17.14.0.0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"https://www.paypal.com/paypalme/inx707\", Pattern match: \"https://api.ipify.org/?format=text\", Pattern match: \"http://localhost:1337/\", Heuristic match: \"dnlib.pe\", Heuristic match: \"dnlib.io\", Pattern match: \"https://keyauth.win/api/1.2/\", Pattern match: \"https://api.imgbb.com/1/upload?key=\", Heuristic match: \"dnlib.dotnet.md\", Heuristic match: \"\n*.sg\", Heuristic match: \"\n*.sj\", Heuristic match: \"\n*.sa\", Heuristic match: \"\n*.sd\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://www.paypal.com\", Found HTTPS url \"https://api.ipify.org\", Found HTTPS url \"https://keyauth.win\", Found HTTPS url \"https://api.imgbb.com\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"suspicious","category":"Network Related","name":"Reference to an external IP address lookup service identified","description":"\"https://api.ipify.org/?format=text\" (Indicator: \"api.ipify.org\"; File: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1016","id":"string-56","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"GetHostName\" (Indicator: \"gethostname\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-899","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"Found reference to API \"GetRequestStream\" (Indicator: \"GetRequestStream\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.001","id":"string-323","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsHooked_IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"Found string \"ollydbg\" (Indicator: \"ollydbg\"; Source: \"sample.bin\"), Found string \"Prevents some tools that can be used to crack your app like: DnSpy, OllyDBG & etc...\" (Indicator: \"ollydbg\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1518.001","id":"string-5","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"\\\\.\\ROOT\\cimv2\" (Indicator: \"root\\cimv2\"; in Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1047","id":"string-30","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"CreateDecryptor\" (Indicator: \"CreateDecryptor\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1140","id":"string-356","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1140","id":"string-106","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to execute applications in hidden mode (.NET)","description":"Observed Namespace \"System.Windows.Forms.Control\" and MemberReference \"Hide\" in \"1b097fb7b968facb017598df033ffd2c477f84f713a3035fade2667dee14fda2.bin\"\n Observed Namespace \"System.Diagnostics.ProcessStartInfo\" and MemberReference \"set_CreateNoWindow\" in \"1b097fb7b968facb017598df033ffd2c477f84f713a3035fade2667dee14fda2.bin\"","origin":"Static Parser","mitre_attack_id":"T1564.003","relevance":7,"id":"static-161","sources":[{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to load content into memory (.NET)","description":"$3a","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to generate intermediate language instructions (Dotnet)","description":"Observed namespace \"System.Reflection.Emit.DynamicMethod\" and TypeReference \"GetILGenerator\" in \"1b097fb7b968facb017598df033ffd2c477f84f713a3035fade2667dee14fda2.bin\"\n Observed namespace \"System.Reflection.Emit.ILGenerator\" and TypeReference \"Emit\" in \"1b097fb7b968facb017598df033ffd2c477f84f713a3035fade2667dee14fda2.bin\"","origin":"Static Parser","mitre_attack_id":"T1620","relevance":1,"id":"static-171","sources":[{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load content from resource","description":"Observed function \"ResourceManager.GetObject\" in \"1b097fb7b968facb017598df033ffd2c477f84f713a3035fade2667dee14fda2.bin\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-112","sources":[{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load manifest resource from assembly (Dotnet)","description":"Observed namespace \"System.Reflection.Assembly\" and TypeReference \"GetManifestResourceStream\" in \"1b097fb7b968facb017598df033ffd2c477f84f713a3035fade2667dee14fda2.bin\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-173","sources":[{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet code contains potential unpacker","description":"Observed function \"System.Reflection.LoadWithPartialName\" in \"1b097fb7b968facb017598df033ffd2c477f84f713a3035fade2667dee14fda2.bin\"\n Observed function \"System.Reflection.Load\" in \"1b097fb7b968facb017598df033ffd2c477f84f713a3035fade2667dee14fda2.bin\"\n Observed function \"System.Reflection.LoadFile\" in \"1b097fb7b968facb017598df033ffd2c477f84f713a3035fade2667dee14fda2.bin\"","origin":"Static Parser","mitre_attack_id":"T1620","relevance":1,"id":"static-115","sources":[{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains encryption/decryption functions","description":"Observed namespace \"System.Security.Cryptography\" and MemberReference \"CreateDecryptor\" in \"1b097fb7b968facb017598df033ffd2c477f84f713a3035fade2667dee14fda2.bin\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-134","sources":[{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains function to dynamically call methods at runtime","description":"Observed namespace \"System\" and MemberReference \"GetMethod\" in \"1b097fb7b968facb017598df033ffd2c477f84f713a3035fade2667dee14fda2.bin\"\n Observed namespace \"System\" and MemberReference \"GetMethods\" in \"1b097fb7b968facb017598df033ffd2c477f84f713a3035fade2667dee14fda2.bin\"\n Observed namespace \"System.Reflection\" and MemberReference \"GetMethods\" in \"1b097fb7b968facb017598df033ffd2c477f84f713a3035fade2667dee14fda2.bin\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":1,"id":"static-135","sources":[{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file resource with suspicious entropy","description":"1b097fb7b968facb017598df033ffd2c477f84f713a3035fade2667dee14fda2.bin has big resource with name: \"JLX86\" size: \"86016\" and abnormal entropy:\"6.295383488639065\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-129","sources":[{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00005156.00000001.150727.03FC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$4a","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"(System.Collections.Generic.IDictionary`2>,System.UInt32,dnlib.DotNet.Emit.Instruction) at 3e9617df32c2abb8331f0ecfce7721c6-600047f-ctor\n Helpers.MethodBlocks.BlockUtils::AddListEntry(System.Collections.Generic.IDictionary`2>,System.UInt32,dnlib.DotNet.Emit.Instruction) at 3e9617df32c2abb8331f0ecfce7721c6-600016f-ctor\n System.Net.HttpListener::get_Prefixes() at 3e9617df32c2abb8331f0ecfce7721c6-60003d5-api~button","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1040","relevance":5,"id":"stream-33","sources":[{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection","description":"$4c","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1571","relevance":5,"id":"stream-85","sources":[{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Able to capture screenshot","description":"Observed function \"System.Drawing.CopyFromScreen\" in \"1b097fb7b968facb017598df033ffd2c477f84f713a3035fade2667dee14fda2.bin\"","origin":"Static Parser","mitre_attack_id":"T1113","relevance":1,"id":"static-113","sources":[{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Able to perform a screen capture","description":"System.Drawing.Graphics::CopyFromScreen(System.Drawing.Point,System.Drawing.Point,System.Drawing.Size) at 3e9617df32c2abb8331f0ecfce7721c6-6000036-AntiCrackingWithHook~Capture","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1113","relevance":5,"id":"stream-72","sources":[{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"System.Diagnostics.Process::GetProcessById(System.Int32) at 3e9617df32c2abb8331f0ecfce7721c6-600003a-AntiCrackingWithHook~DoWork\n System.Diagnostics.Process::GetProcessById(System.Int32) at 3e9617df32c2abb8331f0ecfce7721c6-600003c-AntiCracking~DoWork\n System.Diagnostics.Process::GetProcessesByName(System.String) at 3e9617df32c2abb8331f0ecfce7721c6-6000335-GUI~protectButton_Click\n System.Diagnostics.Process::GetProcessById(System.Int32) at 3e9617df32c2abb8331f0ecfce7721c6-60003f9-authHelpers~SuspendProcess","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to adjust token privileges","description":"SecureByte.IAdmin.isAdmin::GetTokenInformation(System.IntPtr,SecureByte.IAdmin.isAdmin/TokenInformationClass,System.IntPtr,System.UInt32,System.UInt32&) at 3e9617df32c2abb8331f0ecfce7721c6-600013a-isAdmin~IsRunningWithElevatedPrivileges","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1134.003","relevance":5,"id":"stream-76","sources":[{"report_type":"sandbox","report_id":"6af31e86c22651942908564e"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"\"Wow64Transition@NTDLL.DLL\" in \"