33:"SampleDetailWrapper" 34:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$33"] 3d:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 35:T5b33,Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "sample.bin"), Found reference to API (Indicator: "BCryptCloseAlgorithmProvider"; Source: "sample.bin"), Found reference to API (Indicator: "RtlReleaseSRWLockExclusive"; Source: "sample.bin"), Found reference to API (Indicator: "NetGetJoinInformation"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteFileW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "CredFree"; Source: "sample.bin"), Found reference to API (Indicator: "RpcStringBindingParseW"; Source: "sample.bin"), Found reference to API (Indicator: "RtlAcquireSRWLockShared"; Source: "sample.bin"), Found reference to API (Indicator: "WTSQuerySessionInformationW"; Source: "sample.bin"), Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "sample.bin"), Found reference to API (Indicator: "CopySid"; Source: "sample.bin"), Found reference to API (Indicator: "LsaConnectUntrusted"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "sample.bin"), Found reference to API (Indicator: "BCryptGetProperty"; Source: "sample.bin"), Found reference to API (Indicator: "RpcBindingVectorFree"; Source: "sample.bin"), Found reference to API (Indicator: "RtlGetOwnerSecurityDescriptor"; Source: "sample.bin"), Found reference to API (Indicator: "UuidToStringW"; Source: "sample.bin"), Found reference to API (Indicator: "FlushFileBuffers"; Source: "sample.bin"), Found reference to API (Indicator: "FreeSid"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileSizeEx"; Source: "sample.bin"), Found reference to API (Indicator: "SetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "AccessCheck"; Source: "sample.bin"), Found reference to API (Indicator: "GetSecurityDescriptorOwner"; Source: "sample.bin"), Found reference to API (Indicator: "RpcBindingToStringBindingW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "RpcServerRegisterIfEx"; Source: "sample.bin"), Found reference to API (Indicator: "CoInitializeEx"; Source: "sample.bin"), Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "sample.bin"), Found reference to API (Indicator: "SetEndOfFile"; Source: "sample.bin"), Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptorW"; Source: "sample.bin"), Found reference to API (Indicator: "RtlGetControlSecurityDescriptor"; Source: "sample.bin"), Found reference to API (Indicator: "EqualSid"; Source: "sample.bin"), Found reference to API (Indicator: "NetApiBufferFree"; Source: "sample.bin"), Found reference to API (Indicator: "OpenEventW"; Source: "sample.bin"), Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "sample.bin"), Found reference to API (Indicator: "GetNamedSecurityInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "ConvertSecurityDescriptorToStringSecurityDescriptorW"; Source: "sample.bin"), Found reference to API (Indicator: "RtlAdjustPrivilege"; Source: "sample.bin"), Found reference to API (Indicator: "CreateWellKnownSid"; Source: "sample.bin"), Found reference to API (Indicator: "GetSecurityDescriptorGroup"; Source: "sample.bin"), Found reference to API (Indicator: "GetSecurityDescriptorLength"; Source: "sample.bin"), Found reference to API (Indicator: "CloseServiceHandle"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "RtlCreateSecurityDescriptor"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "DeviceIoControl"; Source: "sample.bin"), Found reference to API (Indicator: "SubmitThreadpoolWork"; Source: "sample.bin"), Found reference to API (Indicator: "PathAddBackslashW"; Source: "sample.bin"), Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "RtlAddAccessAllowedAce"; Source: "sample.bin"), Found reference to API (Indicator: "CloseThreadpoolCleanupGroupMembers"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "NtQueryInformationToken"; Source: "sample.bin"), Found reference to API (Indicator: "FormatMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "HeapAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "ChangeTimerQueueTimer"; Source: "sample.bin"), Found reference to API (Indicator: "RtlGetDaclSecurityDescriptor"; Source: "sample.bin"), Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThreadpoolCleanupGroup"; Source: "sample.bin"), Found reference to API (Indicator: "RtlLengthSid"; Source: "sample.bin"), Found reference to API (Indicator: "StringFromCLSID"; Source: "sample.bin"), Found reference to API (Indicator: "RtlCreateAcl"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "RpcStringFreeW"; Source: "sample.bin"), Found reference to API (Indicator: "GetDynamicTimeZoneInformation"; Source: "sample.bin"), Found reference to API (Indicator: "RtlSetSecurityObjectEx"; Source: "sample.bin"), Found reference to API (Indicator: "RtlInitUnicodeString"; Source: "sample.bin"), Found reference to API (Indicator: "LsaQueryInformationPolicy"; Source: "sample.bin"), Found reference to API (Indicator: "RpcServerInqDefaultPrincName"; Source: "sample.bin"), Found reference to API (Indicator: "HeapFree"; Source: "sample.bin"), Found reference to API (Indicator: "RtlFindLeastSignificantBit"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "LookupAccountSidLocalW"; Source: "sample.bin"), Found reference to API (Indicator: "RtlNewSecurityObjectEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetSecurityDescriptorControl"; Source: "sample.bin"), Found reference to API (Indicator: "RtlSetGroupSecurityDescriptor"; Source: "sample.bin"), Found reference to API (Indicator: "RtlDllShutdownInProgress"; Source: "sample.bin"), Found reference to API (Indicator: "CoCreateGuid"; Source: "sample.bin"), Found reference to API (Indicator: "RtlReleaseSRWLockShared"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThread"; Source: "sample.bin"), Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; Source: "sample.bin"), Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "sample.bin"), Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "sample.bin"), Found reference to API (Indicator: "RpcServerRegisterAuthInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "LsaFreeMemory"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseSRWLockShared"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileW"; Source: "sample.bin"), Found reference to API (Indicator: "OutputDebugStringW"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessHeap"; Source: "sample.bin"), Found reference to API (Indicator: "RegNotifyChangeKeyValue"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileW"; Source: "sample.bin"), Found reference to API (Indicator: "RpcServerUseProtseqW"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseMutex"; Source: "sample.bin"), Found reference to API (Indicator: "OpenSemaphoreW"; Source: "sample.bin"), Found reference to API (Indicator: "CheckTokenMembership"; Source: "sample.bin"), Found reference to API (Indicator: "DuplicateToken"; Source: "sample.bin"), Found reference to API (Indicator: "WTSQueryUserToken"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThreadpoolWork"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "LeaveCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "CompareFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "CredEnumerateW"; Source: "sample.bin"), Found reference to API (Indicator: "EnterCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetAce"; Source: "sample.bin"), Found reference to API (Indicator: "GetTokenInformation"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateTimerQueueTimer"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "ResetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "RpcServerRegisterAuthInfo"; Source: "sample.bin"), Found reference to API (Indicator: "RegGetValueW"; Source: "sample.bin"), Found reference to API (Indicator: "RpcServerInqBindings"; Source: "sample.bin"), Found reference to API (Indicator: "GetSidIdentifierAuthority"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "RpcEpUnregister"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleExA"; Source: "sample.bin"), Found reference to API (Indicator: "CoInitialize"; Source: "sample.bin"), Found reference to API (Indicator: "RegisterWaitForSingleObjectEx"; Source: "sample.bin"), Found reference to API (Indicator: "RpcServerUnregisterIf"; Source: "sample.bin"), Found reference to API (Indicator: "LookupAccountNameW"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForMultipleObjectsEx"; Source: "sample.bin"), Found reference to API (Indicator: "DebugBreak"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteTimerQueueTimer"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "ConvertSidToStringSidW"; Source: "sample.bin"), Found reference to API (Indicator: "RtlFreeUnicodeString"; Source: "sample.bin"), Found reference to API (Indicator: "RegFlushKey"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenA"; Source: "sample.bin"), Found reference to API (Indicator: "LsaDeregisterLogonProcess"; Source: "sample.bin"), Found reference to API (Indicator: "CoTaskMemFree"; Source: "sample.bin"), Found reference to API (Indicator: "TzSpecificLocalTimeToSystemTime"; Source: "sample.bin"), Found reference to API (Indicator: "NdrServerCallAll"; Source: "sample.bin"), Found reference to API (Indicator: "MakeSelfRelativeSD"; Source: "sample.bin"), Found reference to API (Indicator: "SetServiceStatus"; Source: "sample.bin"), Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "sample.bin"), Found reference to API (Indicator: "EventRegister"; Source: "sample.bin"), Found reference to API (Indicator: "IIDFromString"; Source: "sample.bin"), Found reference to API (Indicator: "LsaFreeReturnBuffer"; Source: "sample.bin"), Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "sample.bin"), Found reference to API (Indicator: "FileTimeToLocalFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileInformationByHandleEx"; Source: "sample.bin"), Found reference to API (Indicator: "RtlLengthSecurityDescriptor"; Source: "sample.bin"), Found reference to API (Indicator: "AcquireSRWLockShared"; Source: "sample.bin"), Found reference to API (Indicator: "CreateWaitableTimer"; Source: "sample.bin"), Found reference to API (Indicator: "DuplicateHandle"; Source: "sample.bin"), Found reference to API (Indicator: "AddAce"; Source: "sample.bin"), Found reference to API (Indicator: "OpenThreadToken"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "RpcServerUnregisterIfEx"; Source: "sample.bin"), Found reference to API (Indicator: "HeapDestroy"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesExW"; Source: "sample.bin"), Found reference to API (Indicator: "RtlSidDominates"; Source: "sample.bin"), Found reference to API (Indicator: "RpcImpersonateClient"; Source: "sample.bin"), Found reference to API (Indicator: "RtlInitializeSRWLock"; Source: "sample.bin"), Found reference to API (Indicator: "AssocQueryStringW"; Source: "sample.bin"), Found reference to API (Indicator: "LsaClose"; Source: "sample.bin"), Found reference to API (Indicator: "BCryptCreateHash"; Source: "sample.bin"), Found reference to API (Indicator: "RtlSetOwnerSecurityDescriptor"; Source: "sample.bin"), Found reference to API (Indicator: "RaiseFailFastException"; Source: "sample.bin"), Found reference to API (Indicator: "GetSecurityDescriptorSacl"; Source: "sample.bin"), Found reference to API (Indicator: "NtPowerInformation"; Source: "sample.bin"), Found reference to API (Indicator: "HeapSize"; Source: "sample.bin"), Found reference to API (Indicator: "UnregisterWaitEx"; Source: "sample.bin"), Found reference to API (Indicator: "BCryptOpenAlgorithmProvider"; Source: "sample.bin"), Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "sample.bin"), Found reference to API (Indicator: "RtlAddAce"; Source: "sample.bin"), Found reference to API (Indicator: "RegEnumKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "NtCreateFile"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "RtlNtStatusToDosErrorNoTeb"; Source: "sample.bin"), Found reference to API (Indicator: "RtlGetGroupSecurityDescriptor"; Source: "sample.bin"), Found reference to API (Indicator: "IsDebuggerPresent"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFree"; Source: "sample.bin"), Found reference to API (Indicator: "LsaOpenPolicy"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExW"; Source: "sample.bin"), Found reference to API (Indicator: "CopyFileW"; Source: "sample.bin"), Found reference to API (Indicator: "QueryFullProcessImageNameW"; Source: "sample.bin"), Found reference to API (Indicator: "IsValidSid"; Source: "sample.bin"), Found reference to API (Indicator: "OpenServiceW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "NtQueryInformationProcess"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteValueW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcess"; Source: "sample.bin"), Found reference to API (Indicator: "UuidEqual"; Source: "sample.bin"), Found reference to API (Indicator: "GetAclInformation"; Source: "sample.bin"), Found reference to API (Indicator: "RtlFreeSid"; Source: "sample.bin"), Found reference to API (Indicator: "ConvertStringSidToSidW"; Source: "sample.bin"), Found reference to API (Indicator: "RtlAbsoluteToSelfRelativeSD"; Source: "sample.bin"), Found reference to API (Indicator: "RtlInitString"; Source: "sample.bin"), Found reference to API (Indicator: "WTSEnumerateSessionsW"; Source: "sample.bin"), Found reference to API (Indicator: "LsaLookupAuthenticationPackage"; Source: "sample.bin"), Found reference to API (Indicator: "RtlDosPathNameToNtPathName_U_WithStatus"; Source: "sample.bin"), Found reference to API (Indicator: "ServicesActive"; Source: "sample.bin"), Found reference to API (Indicator: "HeapSetInformation"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeAcl"; Source: "sample.bin"), Found reference to API (Indicator: "CoCreateInstance"; Source: "sample.bin"), Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "RtlAcquireSRWLockExclusive"; Source: "sample.bin"), Found reference to API (Indicator: "NdrServerCall2"; Source: "sample.bin"), Found reference to API (Indicator: "QueryServiceStatus"; Source: "sample.bin"), Found reference to API (Indicator: "RtlSetDaclSecurityDescriptor"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseSemaphore"; Source: "sample.bin"), Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "sample.bin"), Found reference to API (Indicator: "StringFromGUID2"; Source: "sample.bin"), Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "sample.bin"), Found reference to API (Indicator: "NtSetInformationFile"; Source: "sample.bin"), Found reference to API (Indicator: "GetSidSubAuthority"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersionExW"; Source: "sample.bin"), Found reference to API (Indicator: "RtlGetAce"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileInformationByHandle"; Source: "sample.bin"), Found reference to API (Indicator: "PrivilegeCheck"; Source: "sample.bin"), Found reference to API (Indicator: "LocalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "RpcEpRegister"; Source: "sample.bin"), Found reference to API (Indicator: "CreateEventW"; Source: "sample.bin"), Found reference to API (Indicator: "UuidCreate"; Source: "sample.bin"), Found reference to API (Indicator: "GetFinalPathNameByHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "WTSFreeMemory"; Source: "sample.bin"), Found reference to API (Indicator: "SetWaitableTimerEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetThreadPreferredUILanguages"; Source: "sample.bin"), Found reference to API (Indicator: "IsWellKnownSid"; Source: "sample.bin"), Found reference to API (Indicator: "SearchPathW"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "sample.bin"), Found reference to API (Indicator: "RpcServerInqCallAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateWaitableTimerExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSidSubAuthorityCount"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileInformationByHandle"; Source: "sample.bin"), Found reference to API (Indicator: "CloseThreadpoolWork"; Source: "sample.bin"), Found reference to API (Indicator: "RpcRevertToSelf"; Source: "sample.bin"), Found reference to API (Indicator: "LoadStringW"; Source: "sample.bin"), Found reference to API (Indicator: "RtlAllocateAndInitializeSid"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "DelayLoadFailureHook"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "sample.bin"), Found reference to API (Indicator: "RtlCaptureContext"; Source: "sample.bin"), Found reference to API (Indicator: "RpcServerInqDefaultPrincNameW"; Source: "sample.bin"), Found reference to API (Indicator: "PrivCopyFileExW"; Source: "sample.bin"), Found reference to API (Indicator: "SeDebugPrivilege"; Source: "sample.bin"), Found reference to API (Indicator: "RpcEpRegisterW"; Source: "sample.bin"), Found reference to API (Indicator: "HeapCreate"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "PathFileExistsW"; Source: "sample.bin"), Found reference to API (Indicator: "RegCreateKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "sample.bin"), Found reference to API (Indicator: "BCryptHashData"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeSRWLock"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "GetComputerNameExW"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileW"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "GetSecurityDescriptorDacl"; Source: "sample.bin"), Found reference to API (Indicator: "CLSIDFromString"; Source: "sample.bin"), Found reference to API (Indicator: "CoUninitialize"; Source: "sample.bin"), Found reference to API (Indicator: "RtlCompareMemory"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "CloseThreadpoolCleanupGroup"; Source: "sample.bin"), Found reference to API (Indicator: "BCryptFinishHash"; Source: "sample.bin"), Found reference to API (Indicator: "GetLengthSid"; Source: "sample.bin"), Found reference to API (Indicator: "SleepConditionVariableSRW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateMutexExW"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "HeapReAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "EventUnregister"; Source: "sample.bin"), Found reference to API (Indicator: "GetComputerNameW"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteTreeW"; Source: "sample.bin"), Found reference to API (Indicator: "LsaCallAuthenticationPackage"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadPreferredUILanguages"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "OpenSCManagerW"; Source: "sample.bin"), Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "sample.bin"), Found reference to API (Indicator: "BCryptDestroyHash"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "SeTakeOwnershipPrivilege"; Source: "sample.bin")36:T39e6,"System\CurrentControlSet\Control\Minint" in Source: sample.bin, "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\CredWom" in Source: sample.bin, "11F000102000000000005200000002002000000021400FF011F00010100000000000512000000000114009F011F00010100000000000512000000000214001601120001010000000000050B00000000021400160112000101000000000005140000000002140016011200010100000000000513000000000B1400FF011F00010100000000000300000000010100000000000512000000010100000000000512000000" valueType="REG_BINARY" /> %windir%\System32\Tasks\* [*] %windir%\System32\Tasks\Microsoft\Windows\UpdateOrchestrator [MusUx_LogonUpdateResults] %windir%\System32\Logfiles\SCM\* [*] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule [HashingCompleted] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Aliases\* [*] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration\* [*] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Maintenance\* [*] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Handlers\* [*] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\* [*] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\CredWom\* [*] %windir%\System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\Server [ServerRoleCollector] %windir%\System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\Server [ServerRoleUsageCollector] %windir%\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\* [*] %windir%\System32\Logfiles\SCM\* [scm*] %windir%\System32\Ta" in Source: sample.bin, "SOFTWARE\Microsoft\Windows NT\CurrentVersion\IdleService" in Source: sample.bin, "11F00010100000000000512000000000314008900120001010000000000050B00000000031400890012000101000000000005130000000003140089001200010100000000000514000000000B1400FF011F00010100000000000300000000010100000000000512000000010100000000000512000000" valueType="REG_BINARY" /> HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\* [*] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Handlers\* [*] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\CredWom\* [*] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration\* [*] %windir%\System32\Logfiles\SCM\* [*] " in Source: sample.bin, " HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\* [*] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Handlers\* [*] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\CredWom\* [*] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule [HashingCompleted] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration\* [*] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Maintenance\* [*] %windir%\System32\Tasks\* [*]