26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 59:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4ed,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan_Win32_Wacatac_B_ml Sample 3884ca8ff0e8… — Score 57/100 — Hybrid Analysis","description":"Malicious verdict for sample 3884ca8ff0e8…. Malware family: Trojan_Win32_Wacatac_B_ml. Threat score 57/100. 3/27 AV engines flagged this file. 1 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2","keywords":["Malicious","Trojan_Win32_Wacatac_B_ml","malware analysis","sandbox report","threat intelligence","3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2"],"about":{"@type":"SoftwareApplication","name":"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin","applicationCategory":["pedll","64bits","executable"],"identifier":"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2","additionalType":"Malicious sample"},"threatScore":57,"malwareFamily":"Trojan_Win32_Wacatac_B_ml","antivirusDetections":{"malicious":3,"total":27},"behavioralIndicators":{"malicious":1,"suspicious":9},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Te00,Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "VirtualFree"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "VirtualAlloc"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "FreeMemory"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "WriteProcessMemory"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") Found reference to API "RtlFreeMemoryBlockLookasi" (Indicator: "FreeMemory"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlFreeMemoryBlockLookasid" (Indicator: "FreeMemory"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlFreeMemoryBlockLookaside" (Indicator: "FreeMemory"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlFreeMemoryB" (Indicator: "FreeMemory"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlFreeMemoryBl" (Indicator: "FreeMemory"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlFreeMemoryBloRtlFRtlFr" (Indicator: "FreeMemory"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlFreeMemoryBloc" (Indicator: "FreeMemory"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlFreeMemoryBlock" (Indicator: "FreeMemory"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlFreeMemoryBlockL" (Indicator: "FreeMemory"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlFreeMemoryBlockLo" (Indicator: "FreeMemory"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlFreeMemoryBlockLoo" (Indicator: "FreeMemory"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlFreeMemoryBlockLook" (Indicator: "FreeMemory"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlFreeMemoryBlockLooka" (Indicator: "FreeMemory"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlFreeMemoryBlockLookasRtlFreeNonVolatil" (Indicator: "FreeMemory"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlMoveMemory" (Indicator: "RtlMoveMemory"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "ZwAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "ZwCreateThread" (Indicator: "CreateThread"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp")28:Te3b,Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "SleepEx"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "GetTickCount64"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "WaitForMultipleObjects"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "NtQuerySystemInformation"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") Found reference to API "RtlQueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlQueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlSetTimer" (Indicator: "SetTimer"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "TpSetTimer" (Indicator: "SetTimer"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "TpSetTimerE" (Indicator: "SetTimer"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "TpSetTimerEx" (Indicator: "SetTimer"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "ZwQueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "ZwSignalAndWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "ZwWaitForMultipleObjects3" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "ZwWaitForMultipleObjects32" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "ZwSetTimer" (Indicator: "SetTimer"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "ZwSetTimer2" (Indicator: "SetTimer"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "ZwSetTimerE" (Indicator: "SetTimer"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "ZwSetTimerEx" (Indicator: "SetTimer"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "ZwSetTimerR" (Indicator: "SetTimer"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "ZwSetTimerRe" (Indicator: "SetTimer"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp")29:T658,file/memory contains long string with (Indicator: "SetThreadToken"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "OpenThreadToken"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") Found reference to API "ZwOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "ZwOpenProcessTokenE" (Indicator: "OpenProcessToken"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "ZwOpenProcessTokenEx" (Indicator: "OpenProcessToken"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "ZwOpenSymbolicLinkObjectZwOpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "ZwOpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "ZwOpenThreadTokenE" (Indicator: "OpenThreadToken"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "ZwOpenThreadTokenEx" (Indicator: "OpenThreadToken"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00000196.00000000.170481.FD428000.00000002.mdmp")2a:T71b,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "FreeLibrary"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "LoadLibrary"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") Found reference to API "FreeLibraryAndExitThreadFreeMemoryJobObject" (Indicator: "FreeLibrary"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "FreeEnvironmentSFreeEnviFreeLibrFreeEnvironmentSFreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp, 00000000-00000196.00000000.170481.FD428000.00000002.mdmp") Found reference to API "FreeLibrFreeLibrFreeLibraryAndExFreeLibraryWhenCFreeMemoFreeResoFreeMemoryJobObjFreeResource" (Indicator: "FreeLibrary"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00000196.00000000.170481.FD428000.00000002.mdmp, 00000000-00000196.00000001.172092.57767000.00000002.mdmp")2b:T656,"rundll32.exe" queried SystemProcessInformation at 00000000-00000196-00000C15-1629764766 [PID: 196] "rundll32.exe" queried SystemProcessInformation at 00000000-00000196-00000C15-1629774379 [PID: 196] "rundll32.exe" queried SystemProcessInformation at 00000000-00000196-00000C15-1630295398 [PID: 196] "rundll32.exe" queried SystemProcessInformation at 00000000-00000196-00000C15-1630309111 [PID: 196] "rundll32.exe" queried SystemProcessInformation at 00000000-00000196-00000C15-1630601179 [PID: 196] "rundll32.exe" queried SystemProcessInformation at 00000000-00000196-00000C15-1630609944 [PID: 196] "rundll32.exe" queried SystemProcessInformation at 00000000-00000196-00000C15-1631012376 [PID: 196] "rundll32.exe" queried SystemProcessInformation at 00000000-00000196-00000C15-1631060950 [PID: 196] "rundll32.exe" queried SystemProcessInformation at 00000000-00003672-00000C15-1629736430 [PID: 3672] "rundll32.exe" queried SystemProcessInformation at 00000000-00003672-00000C15-1629748400 [PID: 3672] "rundll32.exe" queried SystemProcessInformation at 00000000-00003672-00000C15-1630309353 [PID: 3672] "rundll32.exe" queried SystemProcessInformation at 00000000-00003672-00000C15-1630333718 [PID: 3672] "rundll32.exe" queried SystemProcessInformation at 00000000-00003672-00000C15-1630571041 [PID: 3672] "rundll32.exe" queried SystemProcessInformation at 00000000-00003672-00000C15-1630592068 [PID: 3672] "rundll32.exe" queried SystemProcessInformation at 00000000-00003672-00000C15-1631067530 [PID: 3672] "rundll32.exe" queried SystemProcessInformation at 00000000-00003672-00000C15-1631076424 [PID: 3672]2c:T6363,Found api reference "bad g0 stackself-preemptbad recoverybad g statusentersyscallcas64 failedabi mismatchwrong timerstrace buffergotypesaliashttpmuxgo121multipathtcprandautoseedtlsunsafeekmunknown sizelevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynameDeleteServiceStartServiceWGetIfEntry2ExFindResourceWGetDriveTypeWModule32NextWThread32FirstWaitCommEventRtlGetVersionRtlInitStringCoTaskMemFreeEnumProcessesShellExecuteWExitWindowsExGetClassNameWtimeEndPeriodWTSFreeMemorywakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata, not pointerdouble unlockmin too largeload64 failedxadd64 failedxchg64 failednil stackbasedalTLDpSugct?GetTempPath2Wcrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizepjwsjqgfxj.iqqfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprot" (Indicator: "CertOpenStore"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") Found api reference "col errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeGetProcAddressProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #ControlServiceCreateServiceWIsWellKnownSidMakeAbsoluteSDOpenSCManagerWSetThreadTokenClearCommBreakClearCommErrorCreateEventExWCreateMutexExWGetTickCount64IsWow64ProcessLoadLibraryExWModule32FirstWSetConsoleModeSizeofResourceVirtualProtectVirtualQueryExCoInitializeExCoUninitializeGetShellWindowVerQueryValueWuserArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waitnil elem type! to finalizer GC worker initallspans arrayscavenge indexRtlGetVersion" (Indicator: "CertCloseStore"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") Found api reference "col errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeGetProcAddressProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #ControlServiceCreateServiceWIsWellKnownSidMakeAbsoluteSDOpenSCManagerWSetThreadTokenClearCommBreakClearCommErrorCreateEventExWCreateMutexExWGetTickCount64IsWow64ProcessLoadLibraryExWModule32FirstWSetConsoleModeSizeofResourceVirtualProtectVirtualQueryExCoInitializeExCoUninitializeGetShellWindowVerQueryValueWuserArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waitnil elem type! to finalizer GC worker initallspans arrayscavenge indexRtlGetVersion" (Indicator: "CryptGenRandom"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") Found api reference "NetApiBufferFree0123456789abcdefDuplicateTokenExSetEntriesInAclWSetServiceStatusCryptProtectDataCryptQueryObjectConnectNamedPipeCreateJobObjectWCreateNamedPipeWDefineDosDeviceWFindFirstVolumeWGetLogicalDrivesGetNamedPipeInfoGetPriorityClassSetDllDirectoryWSetFileValidDataSetPriorityClassVirtualProtectExRtlGetCurrentPebEnumChildWindowsGetDesktopWindowGetGUIThreadInfoWinVerifyTrustExinteger overflowdecoratemappingsgcshrinkstackofftracefpunwindoffGC scavenge waitGC worker (idle)page trace flushselect (durable)heap reservation/gc/gogc:percent, not a functiongc: unswept spanworkbuf is emptymSpanList.removemSpanList.insertbad special kindpage alloc indexbad summary datatimeBeginPeriod" (Indicator: "CryptQueryObject"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") Found api reference ": value "allowmultiplevcsAmCvlwksXzqdqtmompermission deniedwrong medium typeno data availableexec format errorLookupAccountSidWDnsRecordListFreeGetCurrentProcessGetShortPathNameWWSAEnumProtocolsW0123456789ABCDEFXreflect.Value.IntAdjustTokenGroupsIsTokenRestrictedCertFindExtensionCryptDecodeObjectReadProcessMemoryQueryWorkingSetExGetKeyboardLayoutWTSQueryUserTokengoroutine profileAllThreadsSyscallcontainermaxprocsGC assist markingselect (no cases)sync.RWMutex.Lockwait for GC cycletrace proc statussync.(*Cond).Wait: missing method notetsleepg on g0bad TinySizeClassimmortal metadatag already scannedmark - bad statusscanobject n == 0swept cached spanmarkBits overflowRtlGetCurrentPeb" (Indicator: "CertFindExtension"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin"), Found api reference ": value "allowmultiplevcsAmCvlwksXzqdqtmompermission deniedwrong medium typeno data availableexec format errorLookupAccountSidWDnsRecordListFreeGetCurrentProcessGetShortPathNameWWSAEnumProtocolsW0123456789ABCDEFXreflect.Value.IntAdjustTokenGroupsIsTokenRestrictedCertFindExtensionCryptDecodeObjectReadProcessMemoryQueryWorkingSetExGetKeyboardLayoutWTSQueryUserTokengoroutine profileAllThreadsSyscallcontainermaxprocsGC assist markingselect (no cases)sync.RWMutex.Lockwait for GC cycletrace proc statussync.(*Cond).Wait: missing method notetsleepg on g0bad TinySizeClassimmortal metadatag already scannedmark - bad statusscanobject n == 0swept cached spanmarkBits overflowRtlGetCurrentPeb" (Indicator: "CryptDecodeObject"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") Found api reference "J7W!BK12:=`%tGEbS*UASH!V12:A7SSJ;Ku;H;0I)!12:F%oh?6@)4HF)4lC12:=@d@4CIDu><,6)@12:Da\A]ECY%ODF@B#12:>&\"j< 6)@12:Da\A]ECY%ODF@B#12:>&\"j<,6)@12:Da\A]ECY%ODF@B#12:>&\"j()9&d9C]O76;C[V@916:F#EI]EJ(FEF96`>6B7A)16:k#Ft"'b5<'AL_hO\mCa=16:J(\A.16:d^WQ_bQ\o?VjTiajN?g'16:4%P&&p54'"YJPB^"94H(16:l)Ue.3Y(P(L"@6\c[1j.16:+`U gN5YSX0io*cpdKI0device or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWGetSidSubAuthorityCountQueryServiceLockStatusWRegNotifyChangeKeyValueSetKernelObjectSecurityNotifyIpInterfaceChangeDeleteVolumeMountPointWFlushConsoleInputBufferGetActiveProcessorCountGetLogicalDriveStringsWSetInformationJobObjectSetNamedPipeHandleStateSetProcessPriorityB" (Indicator: "CertGetCertificateChain"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin"), Found api reference "ostNtSetInformationProcessDestroyEnvironmentBlockGetFileVersionInfoSizeWindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked locks.allocCount > s.nelems/gc/heap/allocs:objectsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectbad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCallreflect.Value.Interfacereflect.Value.NumMethodImpersonateLoggedOnUser", missing CPU supportexit hook invoked panicconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWAllocateAndInitialize" (Indicator: "CertFreeCertificateChain"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") Found api reference ": can not enable "hash of unhashable type: invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleGetSecurityDescriptorGroupGetSecurityDescriptorOwnerNotifyServiceStatusChangeWSetSecurityDescriptorGroupSetSecurityDescriptorOwnerCertFindCertificateInStoreFindFirstVolumeMountPointWFindNextChangeNotificationGetConsoleScreenBufferInfoGetProcessWorkingSetSizeExGetSystemWindowsDirectoryWQueryFullProcessImageNameWSetProcessWorkingSetSizeExRtlNtStatusToDosErrorNoTebSetupDiBuildDriverInfoListall goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0/gc/cycles/total:gc-cyclesbad type kind in finalizernegative idle mark workersuse of invalid sweepLockerforEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphor" (Indicator: "CertFindCertificateInStore"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin"), Found api reference ": can not enable "hash of unhashable type: invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleGetSecurityDescriptorGroupGetSecurityDescriptorOwnerNotifyServiceStatusChangeWSetSecurityDescriptorGroupSetSecurityDescriptorOwnerCertFindCertificateInStoreFindFirstVolumeMountPointWFindNextChangeNotificationGetConsoleScreenBufferInfoGetProcessWorkingSetSizeExGetSystemWindowsDirectoryWQueryFullProcessImageNameWSetProcessWorkingSetSizeExRtlNtStatusToDosErrorNoTebSetupDiBuildDriverInfoListall goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0/gc/cycles/total:gc-cyclesbad type kind in finalizernegative idle mark workersuse of invalid sweepLockerforEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphor" (Indicator: "CertFreeCertificateContext"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") Found api reference "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/classes/other:bytes/memory/classes/total:bytesfailed to set sweep barrierwork.nwait was > work.nprocallocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcrunlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positivereflect.Value.UnsafePointerabi.NewName: tag too long: httpservecontentkeepheadersfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGetSecurityDescriptorControlInitializeSecurityDescriptorSetSecurityDescriptorControlNotifyUnicastIpAddressChangeFindFirstChangeNotificationWGetFileInformationByHandleExGetProcessShutdownParam" (Indicator: "CertCreateCertificateContext"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") Found api reference "runtime: sudog with non-nil cgfput: bad status (not Gdead)LockOSThread nesting overflowsemacquire not on the G stackruntime: split stack overflowstring concatenation too longinvalid function symbol tabletrace: reading after shutdowntried to trace dead goroutineruntime: impossible type kindruntime.semasleep wait_failedcrypto/aes: invalid key size J:\Dpukvdz\ZfzDVD64\tzets3.ksssocket operation on non-socketinappropriate ioctl for deviceprotocol wrong type for socketruntime.AddCleanup: ptr is nilGetSecurityDescriptorRMControlQueryServiceDynamicInformationSetSecurityDescriptorRMControlCertDeleteCertificateFromStoreGetProcessPreferredUILanguagesGetSystemTimePreciseAsFileTimeSetupDiCreateDeviceInfoListExWSetupDiGetDeviceInstallParamsWSetupDiSetDeviceInstallParamsWassignment to entry in nil map (types from different scopes)notetsleep - waitm out of syncfailed to get system page size/cpu/classes/total:cpu-seconds/gc/cycles/automatic:gc-cycles/sched/pauses/total/gc:seconds/sync/mutex/wait/total:seconds/godebug/non-de" (Indicator: "CertDeleteCertificateFromStore"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") Found api reference ": unknown cpu feature "reflect: Len of non-array typesubtle.XORBytes: dst too shortL:\Frwmxfb\BhbFXF64\muuqxbc.ngncannot assign requested address.lib section in a.out corruptedCertDuplicateCertificateContextSetupDiGetDeviceInfoListDetailWslice bounds out of range [:%x]slice bounds out of range [%x:]call from within the Go runtimeinternal error - misuse of itabruntime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytesnon in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedunsafe.String: len out of rangereflect: Len of non-array type crypto/aes: len(dst) < len(src)I:\Cotjucy\YeyCUC64\xatjrr32.kdkF:\Zlqgrzv\VbvZRZ64\uxqgoo32.hahresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyGetVolumePathNamesForVolumeNameWsl" (Indicator: "CertAddCertificateContextToStore"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin"), Found api reference ": unknown cpu feature "reflect: Len of non-array typesubtle.XORBytes: dst too shortL:\Frwmxfb\BhbFXF64\muuqxbc.ngncannot assign requested address.lib section in a.out corruptedCertDuplicateCertificateContextSetupDiGetDeviceInfoListDetailWslice bounds out of range [:%x]slice bounds out of range [%x:]call from within the Go runtimeinternal error - misuse of itabruntime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytesnon in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedunsafe.String: len out of rangereflect: Len of non-array type crypto/aes: len(dst) < len(src)I:\Cotjucy\YeyCUC64\xatjrr32.kdkF:\Zlqgrzv\VbvZRZ64\uxqgoo32.hahresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyGetVolumePathNamesForVolumeNameWsl" (Indicator: "CertDuplicateCertificateContext"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") Found api reference ": unknown cpu feature "reflect: Len of non-array typesubtle.XORBytes: dst too shortL:\Frwmxfb\BhbFXF64\muuqxbc.ngncannot assign requested address.lib section in a.out corruptedCertDuplicateCertificateContextSetupDiGetDeviceInfoListDetailWslice bounds out of range [:%x]slice bounds out of range [%x:]call from within the Go runtimeinternal error - misuse of itabruntime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytesnon in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedunsafe.String: len out of rangereflect: Len of non-array type crypto/aes: len(dst) < len(src)I:\Cotjucy\YeyCUC64\xatjrr32.kdkF:\Zlqgrzv\VbvZRZ64\uxqgoo32.hahresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyGetVolumePathNamesForVolumeNameWsl" (Indicator: "CertVerifyCertificateChainPolicy"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin"), Found api reference "_cgo_pthread_key_created missingruntime: sudog with non-nil elemruntime: sudog with non-nil nextruntime: sudog with non-nil prevruntime: mcall function returnedruntime: stack split at bad timeruntime.semasleep wait_abandonedMapIter.Value called before Nextcrypto/aes: input not full block" not supported for cpu option "initial table capacity too largesubtle.XORBytes: invalid overlaptoo many levels of symbolic linksInitializeProcThreadAttributeListCryptAcquireCertificatePrivateKeyGetVolumeNameForVolumeMountPointWSetupDiGetDeviceRegistryPropertyWSetupDiSetDeviceRegistryPropertyWslice bounds out of range [%x:%y]misrounded allocation in sysAllocruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stac" (Indicator: "CryptAcquireCertificatePrivateKey"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin"), Found api reference "DuplicateEncryptionInfoFileExt" (Indicator: "DuplicateEncryptionInfoFile"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp")2d:T692,file/memory contains long string with (Indicator: "CertCloseStore"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "CryptProtectData"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "CryptDecodeObject"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "CertGetNameString"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "CryptUnprotectData"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "CryptReleaseContext"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "CertOpenSystemStore"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "CryptAcquireContext"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "CertFindCertificateInStore"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "CertFreeCertificateContext"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "CertDeleteCertificateFromStore"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin")2e:T87d,Observed string: "tls10servercrypto/x509" (Indicator: "tls10servercrypto/x509") in Source: 3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin Observed string: "no deferreturnbad restart PCstopm spinningrandinit twicestore64 failedsemaRoot queuebad allocCountbad span statestack overflowno module dataunsafe.Pointer on zero Valueunknown methodcrypto/fips140mime/multipartx509sha256skidunknown dsbyte\\.\C3G64G55_hnLMASBWX-J0B93L6GHVNWRS-EMQO7UAadvertise errorkey has expirednetwork is downno medium foundno such processGetAdaptersInfoCreateHardLinkWDeviceIoControlDuplicateHandleFlushViewOfFileGetCommandLineWGetProcessTimesGetStartupInfoWProcess32FirstWUnmapViewOfFile" (Indicator: "no deferreturnbad restart PCstopm spinningrandinit twicestore64 failedsemaRoot queuebad allocCountbad span statestack overflowno module dataunsafe.Pointer on zero Valueunknown methodcrypto/fips140mime/multipartx509sha256skidunknown dsbyte\\.\C3G64G55_hnLMASBWX-J0B93L6GHVNWRS-EMQO7UAadvertise errorkey has expirednetwork is downno medium foundno such processGetAdaptersInfoCreateHardLinkWDeviceIoControlDuplicateHandleFlushViewOfFileGetCommandLineWGetProcessTimesGetStartupInfoWProcess32FirstWUnmapViewOfFile") in Source: 3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin Observed string: "not in a stack spanstackalloc not on scheduler stackruntime: text offset out of rangetimer period must be non-negativetoo many concurrent timer firingsruntime: name offset out of rangeruntime: type offset out of rangereflect: slice index out of range of method on nil interface valuereflect: Field index out of rangereflect: array index out of rangecrypto/aes: output not full block" (Indicator: "not in a stack spanstackalloc not on scheduler stackruntime: text offset out of rangetimer period must be non-negativetoo many concurrent timer firingsruntime: name offset out of rangeruntime: type offset out of rangereflect: slice index out of range of method on nil interface valuereflect: Field index out of rangereflect: array index out of rangecrypto/aes: output not full block") in Source: 3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin2f:T16a25,Found XOR loop in file "sample.bin" at offset 87762; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1802924; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2381560; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3315586; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3431264; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3460428; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3626476; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3634436; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4197644; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4228052; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1130893; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1138021; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3028000; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4275063; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 176758; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 211369; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 211697; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 212097; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 213779; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 232177; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 250928; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 382025; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 546282; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1047598; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1047618; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1047637; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1047649; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1047665; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1047684; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1047696; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1047712; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1047731; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1047743; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1047759; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1047778; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1230841; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1331592; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1566959; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1567031; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1567330; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1567395; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1894588; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2301528; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3161883; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3608128; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3609496; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3614872; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3626864; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3633104; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3810536; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3822096; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3868072; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3974416; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4026192; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4179072; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4179096; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4179120; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4179156; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4179240; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4179276; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4179444; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4179624; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4179636; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4179696; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4179708; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4179756; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4179780; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4179792; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4179804; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4179816; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4179828; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4179864; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4179876; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4179900; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4179912; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4179924; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4179972; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4179996; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4180044; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4180104; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4180128; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4180152; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4180164; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4180188; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4180200; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4180236; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4180260; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4180272; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4180284; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4180296; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4180320; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4180380; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4180404; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4180440; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4180452; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4180596; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4180608; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4180620; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4180632; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4180644; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4180704; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4180716; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4180728; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4180740; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4180776; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4180788; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4180800; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4180812; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4180836; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4180908; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4181016; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4181028; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4181040; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4181076; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4181244; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4181280; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4181352; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4181400; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4181436; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4181460; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4181532; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4181724; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4181736; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4181748; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4181796; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4181832; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4181856; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4181868; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4181916; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4181928; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4181940; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4181964; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4181988; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4182000; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4182024; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4182036; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4182060; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4182084; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4182180; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4182204; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4182264; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4182276; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4182312; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4182372; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4182384; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4182408; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4182528; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4182588; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4182672; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4182696; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4182720; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4182732; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4182756; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4182768; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4182804; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4182816; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4182840; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4182864; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4182888; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4182948; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4183008; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4183020; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4183128; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4183200; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4183236; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4183320; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4183332; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4183344; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4183356; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4183464; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4183476; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4183488; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4183596; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4183608; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4183656; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4183740; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4184016; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4184028; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4184112; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4184124; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4184136; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4184148; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4184160; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4184172; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4184232; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4184280; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4184352; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4184388; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4184412; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4184436; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4184532; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4184544; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4184616; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4184628; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4184652; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4184664; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4184700; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4184772; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4184964; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4185204; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4185264; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4185276; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4185288; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4185300; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4185312; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4185324; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4185336; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4185348; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4185360; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4185372; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4185384; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4185396; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4185408; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4185420; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4185432; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4185516; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4185552; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4185576; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4185612; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4185744; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4185756; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4185840; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4185876; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4185888; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4185912; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4185924; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4185948; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4185960; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4185984; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4185996; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4186008; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4186080; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4186092; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4186104; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4186152; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4186164; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4186188; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4186200; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4186224; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4186236; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4186332; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4186356; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4186368; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4186380; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4186392; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4186404; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4186428; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4186452; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4186464; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4186476; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4186536; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4186596; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4186632; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4186920; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4186932; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4186968; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4187004; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4187016; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4187028; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4187076; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4187124; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4187136; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4187148; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4187160; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4187184; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4187196; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4187208; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4187232; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4187244; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4187268; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4187292; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4187340; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4187352; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4187364; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4187424; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4187436; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4187484; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4187496; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4187532; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4187592; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4187616; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4187628; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4187700; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4187712; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4187724; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4187772; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4187820; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4187904; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4187916; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4187976; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4188000; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4188060; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4188132; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4188180; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4188300; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4188396; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4188408; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4188576; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4188612; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4188672; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4188684; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4188696; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4188888; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4188900; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4188960; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4188972; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4188984; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4189032; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4189044; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4189068; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4189128; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4189152; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4189164; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4189176; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4189212; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4189260; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4189392; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4189416; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4189464; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4189476; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4189536; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4189548; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4189560; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4189584; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4189608; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4189632; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4189680; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4189692; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4189764; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4189800; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4189860; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4189944; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4189956; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4189980; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4189992; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4190028; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4190112; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4190124; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4190148; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4190172; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4190184; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4190220; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4190232; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4190268; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4190340; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4190364; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4190376; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4190400; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4190448; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4190520; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4190592; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4190616; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4190628; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4190652; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4190664; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4190700; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4190736; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4190832; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4190844; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4190856; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4190868; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4190880; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4190892; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4190928; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4190952; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4190976; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4190988; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4191000; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4191012; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4191024; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4191036; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4191048; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4191060; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4191072; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4191084; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4191096; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4191108; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4191120; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4191144; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4191156; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4191180; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4191192; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4191204; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4191216; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4191252; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4191264; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4191276; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4191288; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4191300; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4191312; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4191360; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4191372; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4191384; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4191396; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4191408; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4191420; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4191432; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4191444; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4191456; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4191564; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4191588; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4191600; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4191624; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4191636; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4191648; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4191672; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4191684; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4191696; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4191708; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4191720; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4191732; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4191756; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4191768; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4191792; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4191840; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4191852; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4191876; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4191900; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4191924; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4191948; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4191972; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4191996; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4192008; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4192020; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4192032; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4192044; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4192068; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4192164; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4192200; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4192212; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4192224; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4192236; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4192248; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4192260; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4192284; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4192296; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4192308; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4192320; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4192332; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4192344; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4192404; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4192476; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4192488; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4192500; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4192560; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4192572; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4192608; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4192656; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4193352; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4193364; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4193376; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4193388; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4193400; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4193580; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4193592; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4193604; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4193616; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4193628; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4193640; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4193664; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4193676; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4193688; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4193700; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4193712; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4193724; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4193736; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4193748; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4193760; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4193772; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4193784; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4193796; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4193808; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4193832; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4194048; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4194180; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4194192; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4194204; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4194228; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4194276; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4194300; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4194312; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4194456; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4194480; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4194756; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4194780; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4194816; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4194852; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4194876; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4194888; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4194900; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4194912; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4194924; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4194936; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4194960; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4194996; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4195008; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4195020; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4195044; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4195056; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4195068; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4195080; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4195092; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4195500; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4195524; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4195548; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4195560; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4195680; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4195728; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4195824; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4196124; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4196136; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4196148; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4196160; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4196172; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4196184; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4196196; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4196256; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4196472; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4196976; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4197408; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4197516; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4199112; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4199136; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4199184; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4199196; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4199232; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4199244; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4199280; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4199352; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4199400; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4199436; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4199472; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4199520; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4199532; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4199544; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4199592; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4199604; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4199724; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4199748; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4199760; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4199772; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4199832; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4199880; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4199904; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4199916; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4199928; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4199976; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4200000; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4200012; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4200084; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4200108; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4200120; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4200144; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4200168; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4200180; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4200192; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4200204; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4200216; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4200228; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4200276; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4200312; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4200360; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4200372; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4200396; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4200456; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4200480; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4200492; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4200528; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4200600; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4200624; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4200672; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4200684; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4200720; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4200768; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4200792; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4200828; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4200888; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4200912; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4200924; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4200936; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4200960; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4201032; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4201092; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4201140; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4201176; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4201260; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4201344; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4201356; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4201380; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4201392; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4201440; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4201452; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4201464; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4201488; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4201536; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4201548; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4201560; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4201656; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4201692; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4201704; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4201716; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4201728; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4201740; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4201764; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4201788; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4201836; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4201908; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4201920; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4201932; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4201956; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4201968; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4201992; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4202040; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4202052; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4202112; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4202136; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4202160; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4202172; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4202184; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4202196; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4202268; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4202280; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4202292; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4202340; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4202376; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4202412; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4202496; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4202520; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4202532; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4202556; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4202676; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4202700; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4202736; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4202748; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4202784; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4202808; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4202832; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4202856; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4202880; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4202916; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4202976; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4203012; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4203024; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4203084; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4203096; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4203924; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4203984; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4204044; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4204068; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4204164; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4204176; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4204188; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4204200; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4204848; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4205172; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4205184; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4205292; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4205304; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4205316; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4205352; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4205412; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4205460; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4205484; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4205520; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4205556; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4205628; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4205640; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4205676; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4205688; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4205760; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4205772; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4205820; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4205892; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4205904; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4205916; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4206024; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4206228; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4206240; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4206264; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4206348; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4206408; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4206444; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4206456; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4206468; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4206480; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4206516; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4206540; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4207212; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4207224; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4207332; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4207452; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4207572; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4207656; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4207704; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4207740; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4207956; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4207968; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4207980; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4207992; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4208280; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4208304; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4208544; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4208556; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4208820; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4208832; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4208868; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4208964; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4208976; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4209048; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4209216; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4209276; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4209324; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4209384; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4209420; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4209540; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4209576; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4209660; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4209696; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4209744; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4209768; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4209900; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4209936; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4209972; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4210092; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4210128; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4210164; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4210344; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4210404; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4210524; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4210572; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4210608; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4210716; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4210740; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4210752; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4210944; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4210980; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4210992; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4211004; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4211136; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4211160; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4211208; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4211220; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4211292; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4211316; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4211376; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4211424; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4211472; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4211496; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4211592; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4211664; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4211796; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4211820; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4212012; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4212036; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4212048; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4212060; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4212072; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4212552; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4212888; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4213092; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4213128; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4213140; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4213152; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4213164; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4213176; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4213188; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4213200; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4213212; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4213224; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4213236; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4213248; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4213260; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4213296; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4213320; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4213332; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4213344; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4213368; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4213500; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4213512; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4213548; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4213608; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4213800; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4213884; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4213896; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4213908; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4214028; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4214040; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4214052; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4214184; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4214196; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4214472; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4214568; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4214580; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4214616; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4214628; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4214640; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4214664; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4214676; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4214712; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4214724; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4214916; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4214928; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4214940; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4214952; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4214964; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4215000; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4215012; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4215024; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4215036; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4215048; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4215060; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4215084; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4215204; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4215216; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4215228; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4215240; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4215300; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4215336; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4215888; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4215960; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4215972; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4216128; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4216188; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4216416; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4216452; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4216500; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4216668; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4216824; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4217016; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4217196; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4217376; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4217448; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4217460; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4217712; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4217940; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4218192; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4218336; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4218360; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4218600; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4218624; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4218708; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4218732; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4218744; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4218768; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4218780; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4218804; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4218828; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4218960; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4219236; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4219248; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4219260; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4219500; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4219512; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4219668; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4219740; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4219752; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4219824; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4220976; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4221432; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4221444; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4221480; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4221540; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4221552; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4221588; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4221684; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4221744; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4221804; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4221876; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4221888; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4221924; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4221936; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4221948; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4221960; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4221984; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4221996; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4222056; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4222212; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4222236; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4222248; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4222344; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4222368; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4222416; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4222428; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4222452; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4222476; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4222488; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4222536; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4222548; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4222560; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4222584; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4222596; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4222608; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4222644; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4222752; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4222812; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4222872; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4222932; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4222968; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4223040; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4223172; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4223208; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4223220; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4223328; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4223340; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4223352; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4223364; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4223532; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4223580; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4223700; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4223736; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4223844; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4224324; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4224336; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4224492; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4224504; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4224600; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4225104; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4225212; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4225332; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4225344; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4225356; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4225692; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4225752; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4225776; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4226328; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4226364; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4226916; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4227048; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4227984; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4228392; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4228440; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4229152; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4229304; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4229760; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4229880; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4230240; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4230420; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4230576; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4230588; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4230600; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4230636; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4230648; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4230840; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4230876; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4230888; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4230900; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4230912; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4230924; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4231584; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4231596; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4231620; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4231644; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4231716; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4231728; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4231740; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4231752; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4231764; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4231776; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4231800; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4232220; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4232520; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4232616; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4232676; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4232796; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4233060; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4233132; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4233144; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4233276; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4233360; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4233504; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4233600; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4233804; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4233852; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4233888; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4233912; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4233936; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4233984; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4234032; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4234068; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4234104; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4234188; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4234200; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4234236; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4234284; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4234296; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4234344; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4234428; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4234464; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4234512; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4234548; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4234584; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4234596; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4234644; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4234668; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4234692; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4234728; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4234788; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4234800; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4234920; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4234956; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4234968; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4235016; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4235028; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4235052; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4235088; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4235100; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4235136; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4235148; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4235172; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4235184; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4235232; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4235280; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4235292; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4235304; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4235364; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4235376; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4235412; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4235424; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4235448; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4235472; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4235484; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4235532; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4235580; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4235652; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4235724; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4235772; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4235784; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4235820; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4235856; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4235880; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4235892; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4236012; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4236180; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4236312; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4236348; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4236384; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4236396; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4236456; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4236480; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4236540; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4236576; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4236660; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4236684; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4236912; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4236948; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4236972; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4237080; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4237104; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4237128; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4237176; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4237212; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4237224; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4237344; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4237356; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4237428; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4237572; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4237584; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4237644; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4237740; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4237752; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4237764; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4237776; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4237848; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4237872; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4237932; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4237992; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4238004; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4238040; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4238076; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4238100; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4238124; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4238136; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4238160; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4238208; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4238220; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4238244; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4238316; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4238424; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4238436; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4238472; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4238508; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4238544; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4238556; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4238592; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4238628; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4238652; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4238688; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4238712; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4238748; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4238760; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4238784; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4238796; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4238820; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4238856; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4238868; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4238916; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4238928; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4238940; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4238952; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4239000; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4239048; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4239156; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4239180; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4239192; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4239204; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4239216; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4239252; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4239264; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4239276; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4239300; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4239360; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4239372; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4239384; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4239396; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4239432; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4239468; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4239540; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4239576; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4239624; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4239636; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4239672; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4239696; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4239708; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4239756; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4239852; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4239888; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4239900; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4239948; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4239972; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4239984; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4240020; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4240032; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4240068; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4240080; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4240092; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4240176; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4240236; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4240248; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4240272; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4240284; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4240296; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4240308; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4240320; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4240368; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4240404; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4240440; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4240488; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4240512; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4240668; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4240704; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4240716; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4240740; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4240764; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4240788; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4240812; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4240824; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4240848; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4240860; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4240884; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4240896; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4240920; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4240980; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4241052; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4241076; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4241268; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4241400; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4241412; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4241448; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4241460; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4241472; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4241688; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4241748; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4241772; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4241844; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4242480; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4242492; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4242504; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4242528; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4242540; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4242552; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4242564; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4242576; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4242600; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4242636; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4242648; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4242684; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4242708; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4242768; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4242780; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4242852; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4242864; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4242876; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4242948; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4242996; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4243104; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4243128; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4243236; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4243296; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4243332; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4243368; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4243380; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4243404; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4243416; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4243452; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4243464; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4243476; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4243512; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4243524; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4243668; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4243680; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4243704; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4243728; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4243740; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4243752; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4243932; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4243944; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4243956; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4244004; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4244028; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4244040; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4244100; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4244124; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4244172; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4244184; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4244256; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4244280; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4244292; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4244316; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4244364; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4244412; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4244556; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4244688; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4244712; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4244724; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4244772; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4244784; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4244796; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4244892; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4244952; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4244964; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4244976; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4244988; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4245012; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4245024; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4245240; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4245312; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4245336; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4245408; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4245420; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4245432; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4245444; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4245456; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4275781; code bytes = 803030:T559,Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "GetSystemDefaultLCID" (Indicator: "GetSystemDefaultLCID"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp, 00000000-00000196.00000001.172092.00280000.00000004.mdmp") Found reference to API "EnumSystemLocalesA" (Indicator: "EnumSystemLocales"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "GetLocalGetLocalGetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "GetLocalGetLogicGetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp")31:T521,file/memory contains long string with (Indicator: "GetDiskFreeSpace"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "GetDiskFreeSpaceEx"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") Found reference to API "GetDiskFreeSpaceA" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "GetDiskFreeSpaceExA" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "GetDiskFreeSpaceExA" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "GetDiskFreeSpaceW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") file/memory contains long string with (Indicator: "GetDiskFreeSpace"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp")32:T744,Found reference to API "EnumTimeFormatsEx" (Indicator: "EnumTimeFormats"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "GetDateFormatAWorker" (Indicator: "GetDateFormat"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "GetDateFormatWWorker" (Indicator: "GetDateFormat"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") file/memory contains long string with (Indicator: "EnumDateFormats"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") file/memory contains long string with (Indicator: "EnumTimeFormats"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "EnumDateFormatsExA" (Indicator: "EnumDateFormats"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "EnumDateFormatsExEx" (Indicator: "EnumDateFormats"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "EnumDateFormatsExW" (Indicator: "EnumDateFormats"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") file/memory contains long string with (Indicator: "GetDateFormat"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "GetDateFormatA" (Indicator: "GetDateFormat"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "GetDateFormatAWoGetDateFGetDateFGetDateFormatEx" (Indicator: "GetDateFormat"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp")33:Tdb9,Found system information discovery API: "GetSystemInfo" in file "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin" Found system information discovery API: "GetEnvironmentStringsW" in file "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin" Found system information discovery API: "GetEnvironmentStrings (in long string)" in file "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin" Found system information discovery API: "QuerySystemInformation (in long string)" in file "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin" Found system information discovery API: "ExpandEnvironmentStrings (in long string)" in file "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin" Found system information discovery API: "RtlNtStatusToDosError (in long string)" in file "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin" Found system information discovery API: "RtlExpandEnvironmentStrings" in "00000000-00000196.00000000.170481.00280000.00000004.mdmp" Found system information discovery API: "RtlExpandEnvironmentStrings_" in "00000000-00000196.00000000.170481.00280000.00000004.mdmp" Found system information discovery API: "RtlExpandEnvironmentStrings_U" in "00000000-00000196.00000000.170481.00280000.00000004.mdmp" Found system information discovery API: "RtlGetNativeSystemInforma" in "00000000-00000196.00000000.170481.00280000.00000004.mdmp" Found system information discovery API: "RtlGetNativeSystemInformat" in "00000000-00000196.00000000.170481.00280000.00000004.mdmp" Found system information discovery API: "RtlGetNativeSystemInformati" in "00000000-00000196.00000000.170481.00280000.00000004.mdmp" Found system information discovery API: "RtlGetNativeSystemInformatio" in "00000000-00000196.00000000.170481.00280000.00000004.mdmp" Found system information discovery API: "RtlGetNativeSystemInformation" in "00000000-00000196.00000000.170481.00280000.00000004.mdmp" Found system information discovery API: "RtlGetNativeSystemInfo" in "00000000-00000196.00000000.170481.00280000.00000004.mdmp" Found system information discovery API: "RtlGetNativeSystemInfor" in "00000000-00000196.00000000.170481.00280000.00000004.mdmp" Found system information discovery API: "RtlGetNativeSystemInformRtlGetNextEntryHa" in "00000000-00000196.00000000.170481.00280000.00000004.mdmp" Found system information discovery API: "RtlNtStatusToDosErrorNoTe" in "00000000-00000196.00000000.170481.00280000.00000004.mdmp" Found system information discovery API: "RtlNtStatusToDosErrorNoTeb" in "00000000-00000196.00000000.170481.00280000.00000004.mdmp" Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00000196.00000000.170481.00280000.00000004.mdmp, 00000000-00000196.00000000.170481.FD428000.00000002.mdmp" Found system information discovery API: "RtlNtStatusToDosErrorN" in "00000000-00000196.00000000.170481.00280000.00000004.mdmp" Found system information discovery API: "RtlNtStatusToDosErrorNo" in "00000000-00000196.00000000.170481.00280000.00000004.mdmp" Found system information discovery API: "RtlNtStatusToDosErrorNoTRtlNumberGenericT" in "00000000-00000196.00000000.170481.00280000.00000004.mdmp" Found system information discovery API: "ZwQuerySystemInformationE" in "00000000-00000196.00000000.170481.00280000.00000004.mdmp" Found system information discovery API: "ZwQuerySystemInformationEx" in "00000000-00000196.00000000.170481.00280000.00000004.mdmp"34:T9de,"rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000196) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000196) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003672) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003672)35:Tfda,file/memory contains long string with (Indicator: "FindNextVolume"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "FindVolumeClose"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "FindFirstVolume"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "GetVolumePathName"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "SetVolumeMountPoint"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "FindNextVolumeMountPoint"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "FindVolumeMountPointClose"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "FindFirstVolumeMountPoint"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "GetVolumePathNamesForVolumeName"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") Found reference to API "FindFirstVolumeMountPointA" (Indicator: "FindFirstVolume"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "FindFirstVolumeMountPointA" (Indicator: "FindFirstVolumeMountPoint"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "FindFirstVolumeMountPointW" (Indicator: "FindFirstVolume"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "FindFirstVolumeMountPointW" (Indicator: "FindFirstVolumeMountPoint"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "FindNextVolumeMountPointA" (Indicator: "FindNextVolume"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "FindNextVolumeMountPointA" (Indicator: "FindNextVolumeMountPoint"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "FindNextVolumeMountPointW" (Indicator: "FindNextVolume"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "FindNextVolumeMountPointW" (Indicator: "FindNextVolumeMountPoint"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "FindVolumeMountPointClose" (Indicator: "FindVolumeMountPointClose"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "FindFirstStreamTFindFirsFindFirsFindFirstStreamWFindFirstStreamWFindFirstVolumeAFindFirstVolumeAFindFirsFindFirsFindFirstVolumeMFindFirstVolumeMFindFirsFindNLSSFindFirstVolumeWFindFirstVolumeWFindNLSString" (Indicator: "FindFirstVolume"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "FindNextFindNextFindNextVolumeA" (Indicator: "FindNextVolume"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "FindNextVolumeA" (Indicator: "FindNextVolume"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "FindNextVolumeMoFindNextFindNextFindNextVolumeMoFindNextVolumeW" (Indicator: "FindNextVolume"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "FindNextVolumeW" (Indicator: "FindNextVolume"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "FindStringOrdinaFindVoluFindVoluFindVolumeClose" (Indicator: "FindVolumeClose"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "FindVolumeClose" (Indicator: "FindVolumeClose"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp")36:T647,file/memory contains long string with (Indicator: "GetSystemTime"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") Found reference to API "RtlGetSystemPreferredUILRtlGetSystemTimeP" (Indicator: "GetSystemTime"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlGetSystemTimePr" (Indicator: "GetSystemTime"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlGetSystemTimePre" (Indicator: "GetSystemTime"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlGetSystemTimePrec" (Indicator: "GetSystemTime"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlGetSystemTimePreci" (Indicator: "GetSystemTime"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlGetSystemTimePrecis" (Indicator: "GetSystemTime"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlGetSystemTimePrecise" (Indicator: "GetSystemTime"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlGetSystemTimeRtlGRtlGe" (Indicator: "GetSystemTime"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00000196.00000000.170481.FD428000.00000002.mdmp")37:T647,file/memory contains long string with (Indicator: "GetSystemTime"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") Found reference to API "RtlGetSystemPreferredUILRtlGetSystemTimeP" (Indicator: "GetSystemTime"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlGetSystemTimePr" (Indicator: "GetSystemTime"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlGetSystemTimePre" (Indicator: "GetSystemTime"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlGetSystemTimePrec" (Indicator: "GetSystemTime"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlGetSystemTimePreci" (Indicator: "GetSystemTime"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlGetSystemTimePrecis" (Indicator: "GetSystemTime"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlGetSystemTimePrecise" (Indicator: "GetSystemTime"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlGetSystemTimeRtlGRtlGe" (Indicator: "GetSystemTime"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00000196.00000000.170481.FD428000.00000002.mdmp")38:T81f,Found registry modification API: "ZwCreateKeyTransa" in "00000000-00000196.00000000.170481.00280000.00000004.mdmp" Found registry modification API: "ZwCreateKeyTransac" in "00000000-00000196.00000000.170481.00280000.00000004.mdmp" Found registry modification API: "ZwCreateKeyTransact" in "00000000-00000196.00000000.170481.00280000.00000004.mdmp" Found registry modification API: "ZwCreateKeyTransacte" in "00000000-00000196.00000000.170481.00280000.00000004.mdmp" Found registry modification API: "ZwCreateKeyTransacted" in "00000000-00000196.00000000.170481.00280000.00000004.mdmp" Found registry modification API: "ZwCreateKeyedEven" in "00000000-00000196.00000000.170481.00280000.00000004.mdmp" Found registry modification API: "ZwCreateKeyedEvent" in "00000000-00000196.00000000.170481.00280000.00000004.mdmp" Found registry modification API: "ZwCreateKey" in "00000000-00000196.00000000.170481.00280000.00000004.mdmp" Found registry modification API: "ZwCreateKeyT" in "00000000-00000196.00000000.170481.00280000.00000004.mdmp" Found registry modification API: "ZwCreateKeyTr" in "00000000-00000196.00000000.170481.00280000.00000004.mdmp" Found registry modification API: "ZwCreateKeyTra" in "00000000-00000196.00000000.170481.00280000.00000004.mdmp" Found registry modification API: "ZwCreateKeyTran" in "00000000-00000196.00000000.170481.00280000.00000004.mdmp" Found registry modification API: "ZwCreateKeyTransZwCrZwCre" in "00000000-00000196.00000000.170481.00280000.00000004.mdmp" Found registry modification API: "ZwCreateKeye" in "00000000-00000196.00000000.170481.00280000.00000004.mdmp" Found registry modification API: "ZwCreateKeyed" in "00000000-00000196.00000000.170481.00280000.00000004.mdmp" Found registry modification API: "ZwCreateKeyedE" in "00000000-00000196.00000000.170481.00280000.00000004.mdmp" Found registry modification API: "ZwCreateKeyedEv" in "00000000-00000196.00000000.170481.00280000.00000004.mdmp" Found registry modification API: "ZwCreateKeyedEveZwCrZwCre" in "00000000-00000196.00000000.170481.00280000.00000004.mdmp"39:T796,"rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000196) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000196) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000196) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000196) "rundll32.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00000196) "rundll32.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00000196) "rundll32.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00000196) "rundll32.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00000196) "rundll32.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00000196) "rundll32.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00000196) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003672) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003672) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003672) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003672) "rundll32.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00003672) "rundll32.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003672) "rundll32.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00003672) "rundll32.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00003672) "rundll32.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003672) "rundll32.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00003672)3a:T3596,"rundll32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter NtCreateWaitCompletionPacket (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter NtAssociateWaitCompletionPacket (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter NtCancelWaitCompletionPacket (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter timeBeginPeriod (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter timeEndPeriod (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter NtQueryInformationFile (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter SetFileCompletionNotificationModes (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter WSAEnumProtocolsW (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter GetVolumeInformationByHandleW (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00000196) "rundll32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter NtCreateWaitCompletionPacket (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter NtAssociateWaitCompletionPacket (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter NtCancelWaitCompletionPacket (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter timeBeginPeriod (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter timeEndPeriod (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter NtQueryInformationFile (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter SetFileCompletionNotificationModes (UID: 00000000-00003672) "rundll32.exe" called "GetProcAddress" with a parameter WSAEnumProtocolsW (UID: 00000000-00003672)3b:Tea1,file/memory contains long string with (Indicator: "CreateProcess"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") Found reference to API "RtlCreateProcessP" (Indicator: "CreateProcess"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlCreateProcessPa" (Indicator: "CreateProcess"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlCreateProcessPar" (Indicator: "CreateProcess"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlCreateProcessPara" (Indicator: "CreateProcess"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlCreateProcessParam" (Indicator: "CreateProcess"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlCreateProcessParame" (Indicator: "CreateProcess"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlCreateProcessParamet" (Indicator: "CreateProcess"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlCreateProcessParameteRtlCreateProcessP" (Indicator: "CreateProcess"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlCreateProcessParameteRtlCreateProcessR" (Indicator: "CreateProcess"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlCreateProcessRe" (Indicator: "CreateProcess"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlCreateProcessRef" (Indicator: "CreateProcess"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlCreateProcessRefl" (Indicator: "CreateProcess"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlCreateProcessRefle" (Indicator: "CreateProcess"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlCreateProcessReflec" (Indicator: "CreateProcess"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlCreateProcessReflect" (Indicator: "CreateProcess"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlCreateProcessReflectiRtlCreateQueryDeb" (Indicator: "CreateProcess"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlCreateProcessRtlCRtlCr" (Indicator: "CreateProcess"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlCreateProcessParameter" (Indicator: "CreateProcess"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlCreateProcessParameters" (Indicator: "CreateProcess"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlCreateProcessParametersE" (Indicator: "CreateProcess"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlCreateProcessParametersEx" (Indicator: "CreateProcess"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlCreateProcessReflectio" (Indicator: "CreateProcess"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlCreateProcessReflection" (Indicator: "CreateProcess"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlpConvertRelativeToAbsoluteSecRtlpCreateProcessRegistry" (Indicator: "CreateProcess"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp")3c:T8c8,file/memory contains long string with (Indicator: "CreateDirectory"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") Found reference to API "ZwConvertBetweenAuxiliaryCounterZwCreateDirectoryObjectEx" (Indicator: "CreateDirectory"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "ZwCreateDirectory" (Indicator: "CreateDirectory"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "ZwCreateDirectoryO" (Indicator: "CreateDirectory"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "ZwCreateDirectoryOb" (Indicator: "CreateDirectory"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "ZwCreateDirectoryObj" (Indicator: "CreateDirectory"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "ZwCreateDirectoryObje" (Indicator: "CreateDirectory"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "ZwCreateDirectoryObjec" (Indicator: "CreateDirectory"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "ZwCreateDirectoryObject" (Indicator: "CreateDirectory"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "ZwCreateDirectoryObjectEZwCreateEnlistmen" (Indicator: "CreateDirectory"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "CreateDirectoryExA" (Indicator: "CreateDirectory"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "CreateDirectoryExW" (Indicator: "CreateDirectory"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "CreateDirectoryTransactedA" (Indicator: "CreateDirectory"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "CreateDirectoryTransactedW" (Indicator: "CreateDirectory"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") file/memory contains long string with (Indicator: "CreateDirectory"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp")3d:T509,file/memory contains long string with (Indicator: "DeviceIoControl"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") Found reference to API "ZwDeviceIoControl" (Indicator: "DeviceIoControl"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "ZwDeviceIoControlF" (Indicator: "DeviceIoControl"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "ZwDeviceIoControlFi" (Indicator: "DeviceIoControl"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "ZwDeviceIoControlFil" (Indicator: "DeviceIoControl"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "ZwDeviceIoControlFile" (Indicator: "DeviceIoControl"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "ZwFsControlFile" (Indicator: "FsControlFile"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") file/memory contains long string with (Indicator: "DeviceIoControl"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "DeviceIoControl" (Indicator: "DeviceIoControl"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp")3e:Tbd4,file/memory contains long string with (Indicator: "CreateFile"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "NtOpenFile"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "NtCreateFile"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") Found reference to API "ZwCreateFile" (Indicator: "CreateFile"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "ZwCreateFile" (Indicator: "ZwCreateFile"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "ZwOpenFile" (Indicator: "ZwOpenFile"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "AppPolicyGetCreateFileAccess" (Indicator: "CreateFile"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "CreateFileMappingFromApp" (Indicator: "CreateFile"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "CreateFileMappingNumaA" (Indicator: "CreateFile"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "CreateFileMappingNumaW" (Indicator: "CreateFile"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "CreateFileTransactedA" (Indicator: "CreateFile"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "CreateFileTransactedW" (Indicator: "CreateFile"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "CreateFiCreateFiCreateFile2" (Indicator: "CreateFile"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "CreateFile2" (Indicator: "CreateFile"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "CreateFiCreateFiCreateFileMappinCreateFileMappinCreateFiCreateFiCreateFileMappinCreateFileMappinCreateFiCreateFiCreateFileMappinCreateFileTransaCreateFiCreateFiCreateFileTransaCreateFileW" (Indicator: "CreateFile"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp, 00000000-00000196.00000000.170481.FD428000.00000002.mdmp") Found reference to API "C:\Windows\MicroCreateFileW" (Indicator: "CreateFile"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp")3f:T7a0,file/memory contains long string with (Indicator: "LoadResource"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "LockResource"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "FindResource"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "SizeofResource"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") Found reference to API "FindPackFindResoFindPackagesByPaFindResourceA" (Indicator: "FindResource"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "FindResoFindResoFindResourceExA" (Indicator: "FindResource"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "FindResourceExA" (Indicator: "FindResource"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "FindResoFindStriFindResourceW" (Indicator: "FindResource"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "FreeLibrFreeLibrFreeLibraryAndExFreeLibraryWhenCFreeMemoFreeResoFreeMemoryJobObjFreeResource" (Indicator: "FreeResource"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp")40:T405,Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "OpenThread"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "ResumeThread"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin")41:T5f5,"rundll32.exe" loaded module "KERNEL32" at base 7ffa86c00000 "rundll32.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffa83e80000 "rundll32.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffa83e80000 "rundll32.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffa83e80000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 2254ea50000 "rundll32.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffa83e80000 "rundll32.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffa83e80000 "rundll32.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffa83e80000 "rundll32.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffa60a00000 "rundll32.exe" loaded module "C:\3884CA8FF0E82370FC831F4B38C4E7004F474AE1A0087FF58B160D5082F031C2.BIN.DLL" at base 7ffa57550000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffa81f60000 "rundll32.exe" loaded module "BCRYPTPRIMITIVES.DLL" at base 7ffa83b70000 "rundll32.exe" loaded module "NTDLL.DLL" at base 7ffa875d0000 "rundll32.exe" loaded module "WINMM.DLL" at base 7ffa7a070000 "rundll32.exe" loaded module "POWRPROF.DLL" at base 7ffa83940000 "rundll32.exe" loaded module "KERNEL32.DLL" at base 7ffa86c00000 "rundll32.exe" loaded module "WS2_32.DLL" at base 7ffa870f0000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 1f58bd10000 "rundll32.exe" loaded module "EXT-MS-WIN-KERNEL32-ERRORHANDLING-L1-1-0.DLL" at base 7ffa86c0000042:T66a,"rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\POLICIES\MICROSOFT\CRYPTOGRAPHY\CONFIGURATION"; Key: ""; Value: "")43:Tef7,"rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "USEFILTER"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "DISABLEHEAPLOOKASIDE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "FRONTENDHEAPDEBUGOPTIONS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "SHUTDOWNFLAGS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "UNLOADEVENTTRACEDEPTH"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "MAXLOADERTHREADS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "USEIMPERSONATEDDEVICEMAP"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "TRACINGFLAGS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "CFGOPTIONS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "MINIMUMSTACKCOMMITINBYTES"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "BREAKONINITIALIZEPROCESSFAILURE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "KEEPACTIVATIONCONTEXTSALIVE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "TRACKACTIVATIONCONTEXTRELEASES"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "MAXDEADACTIVATIONCONTEXTS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "GLOBALFLAG"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "DEBUGPROCESSHEAPONLY"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "SEARCHPATHMODE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "")44:T711,"rundll32.exe" reads file "c:\windows\system32\6v9fpxr0.dll" "rundll32.exe" reads file "c:\windows\system32\@audiotoasticon.png" "rundll32.exe" reads file "c:\windows\system32\@backgroundaccesstoasticon.png" "rundll32.exe" reads file "c:\windows\system32\@enrollmenttoasticon.png" "rundll32.exe" reads file "c:\windows\system32\@notifiertoasticon.png" "rundll32.exe" reads file "c:\windows\system32\@vpntoasticon.png" "rundll32.exe" reads file "c:\windows\system32\@wifinotificationicon.png" "rundll32.exe" reads file "c:\windows\system32\@windowshellofacetoasticon.png" "rundll32.exe" reads file "c:\windows\system32\@windowsupdatetoasticon.contrast-black.png" "rundll32.exe" reads file "c:\windows\system32\@windowsupdatetoasticon.contrast-white.png" "rundll32.exe" reads file "c:\windows\system32\@windowsupdatetoasticon.png" "rundll32.exe" reads file "c:\windows\system32\@wirelessdisplaytoast.png" "rundll32.exe" reads file "c:\windows\system32\@wwannotificationicon.png" "rundll32.exe" reads file "c:\windows\system32\@wwansimlockicon.png" "rundll32.exe" reads file "c:\windows\system32\@bitlockertoastimage.png" "rundll32.exe" reads file "c:\windows\system32\@edptoastimage.png" "rundll32.exe" reads file "c:\windows\system32\@language_notification_icon.png" "rundll32.exe" reads file "c:\windows\system32\@optionalfeatures.png" "rundll32.exe" reads file "c:\windows\system32\acpbackgroundmanagerpolicy.dll" "rundll32.exe" reads file "c:\windows\system32\ajrouter.dll" "rundll32.exe" reads file "c:\windows\system32\aphostclient.dll" "rundll32.exe" reads file "c:\windows\system32\aphostres.dll" "rundll32.exe" reads file "c:\windows\system32\aphostservice.dll" "rundll32.exe" reads file "c:\windows\system32\arp.exe" "rundll32.exe" reads file "c:\windows\system32\audiokse.dll"45:T100a,file/memory contains long string with (Indicator: "CreatePipe"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "CreateNamedPipe"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "ConnectNamedPipe"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "GetNamedPipe"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") Found reference to API "ZwCreateNamedPipe" (Indicator: "CreateNamedPipe"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "ZwCreateNamedPipeF" (Indicator: "CreateNamedPipe"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "ZwCreateNamedPipeFi" (Indicator: "CreateNamedPipe"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "ZwCreateNamedPipeFil" (Indicator: "CreateNamedPipe"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "ZwCreateNamedPipeFile" (Indicator: "CreateNamedPipe"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "GetNamedPipeAttribute" (Indicator: "GetNamedPipe"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "GetNamedPipeHandleStateAGetNamedPipeHandleStateWGetNativeSystemInfo" (Indicator: "GetNamedPipe"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "CallNamedPipeA" (Indicator: "CallNamedPipe"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "CallNameCallbackCallNamedPipeW" (Indicator: "CallNamedPipe"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "CallNamedPipeW" (Indicator: "CallNamedPipe"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") file/memory contains long string with (Indicator: "ConnectNamedPipe"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "CreateNamedPipeACreateNamedPipeACreateNaCreatePiCreateNamedPipeWCreateNamedPipeWCreatePipe" (Indicator: "CreateNamedPipe"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "CreateNamedPipeACreateNamedPipeACreateNaCreatePiCreateNamedPipeWCreateNamedPipeWCreatePipe" (Indicator: "CreatePipe"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "CreatePipe" (Indicator: "CreatePipe"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") file/memory contains long string with (Indicator: "GetNamedPipe"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "GetNamedPipeClientComputerNameA" (Indicator: "GetNamedPipe"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "GetNamedPipeClientComputerNameW" (Indicator: "GetNamedPipe"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "GetNamedPipeClientProcessId" (Indicator: "GetNamedPipe"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "GetNamedPipeClientSessionId" (Indicator: "GetNamedPipe"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "GetNamedPipeHandleStateA" (Indicator: "GetNamedPipe"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "GetNamedPipeHandleStateW" (Indicator: "GetNamedPipe"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "GetNamedPipeServerProcessId" (Indicator: "GetNamedPipe"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "GetNamedPipeServerSessionId" (Indicator: "GetNamedPipe"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp")46:Tf6c,Heuristic match: "9).kh" Heuristic match: "*abi.name" Heuristic match: "*godebugs.info" Heuristic match: "internal/abi.name.name" Heuristic match: "s.info" Pattern match: "eq.sync/atomic.gcivsjjbipw9" Pattern match: "eq.sync/atomic.kno7nhsbq" Pattern match: "eq.sync/atomic.vkejozv3f" Heuristic match: "sync.(*tqpvp6ap0eqh).do" Heuristic match: "egf_ckar1l.bca7kc1rov_j.name" Heuristic match: "egf_ckar1l.(*bca7kc1rov_j).name" Heuristic match: "syscall.mfp3qhc.is" Heuristic match: "syscall.(*mfp3qhc).is" Heuristic match: "ceq99qt9x.(*ls8c4nxo).name" Heuristic match: "h8tyabq0.rier7do6zomj.name" Heuristic match: "h8tyabq0.(*kdwb3kbla8zx).name" Heuristic match: "h8tyabq0.(*orlcn5lha).name" Heuristic match: "h8tyabq0.(*rier7do6zomj).name" Heuristic match: "reflect.(*avevu8zsz).name" Heuristic match: "reflect.rqq8c6iga4.int" Pattern match: "eq.sync/atomic.vibrztj[kekrbc.gaxq6wkrjplc[*internal/abi.type,interface" Pattern match: "eq.sync/atomic.vibrztj[kekrbc.f6ezjgcip[*internal/abi.type,interface" Pattern match: "eq.sync/atomic.vibrztj[kekrbc.o5a1bcr[*internal/abi.type,interface" Heuristic match: "vbame.dllvds.exevbicodec.ax" Heuristic match: "vbisurf.ax" Heuristic match: "vidcap.ax" Heuristic match: "web.rs" Heuristic match: "wstpager.ax" Heuristic match: ".gaming.ui.ga" Heuristic match: "l.feedback.an" Heuristic match: "bdaplgin.ax" Heuristic match: "cob-au.rs" Heuristic match: "format.com" Heuristic match: "ksproxy.ax" Heuristic match: "kstvtune.ax" Heuristic match: "kswdmcap.ax" Heuristic match: "mpeg2data.ax" Heuristic match: "mpg2splt.ax" Heuristic match: "msdtcvsp1res.dllmsdvbnp.ax" Heuristic match: "oflc-nz.rs" Heuristic match: "pegi-pt.rs" Heuristic match: "psisrndr.ax" Heuristic match: ":\windows\system32\kswdmcap.ax" Heuristic match: "pathext=.com" Heuristic match: ".vbs;.vbe;.js;.jse;.wsf;.wsh;.ms" Heuristic match: "c:\windows\system32\mpeg2data.ax" Heuristic match: "c:\windows\syswow64\msdvbnp.ax" Heuristic match: "c:\windows\syswow64\web.rs" Heuristic match: "c:\windows\syswow64\wstpager.ax" Heuristic match: "c:\windows\syswow64\csrr.rs" Heuristic match: "c:\windows\syswow64\esrb.rs" Heuristic match: "c:\windows\syswow64\format.com" Heuristic match: "c:\windows\syswow64\fpb.rs" Heuristic match: "c:\windows\syswow64\g711codc.ax" Heuristic match: "c:\windows\syswow64\ir41_32.ax" Heuristic match: "c:\windows\syswow64\ksproxy.ax" Heuristic match: "c:\windows\syswow64\kstvtune.ax" Heuristic match: "c:\windows\syswow64\ksxbar.ax" Heuristic match: "c:\windows\syswow64\mode.com" Heuristic match: "c:\windows\syswow64\more.com" Heuristic match: "c:\windows\syswow64\mpg2splt.ax" Heuristic match: "c:\windows\syswow64\pcbp.rs" Heuristic match: "c:\windows\syswow64\tree.com" Heuristic match: "c:\windows\system32\djctq.rs" Heuristic match: "c:\windows\syswow64\usk.rs" Heuristic match: "c:\windows\system32\format.com" Heuristic match: "c:\windows\system32\fpb.rs" Heuristic match: "c:\windows\system32\g711codc.ax" Heuristic match: "c:\windows\syswow64\vbisurf.ax" Heuristic match: "c:\windows\syswow64\chcp.com" Heuristic match: "c:\windows\syswow64\cob-au.rs" Heuristic match: "c:\windows\syswow64\djctq.rs" Heuristic match: "c:\windows\syswow64\grb.rs" Heuristic match: "c:\windows\syswow64\iac25_32.ax" Heuristic match: "c:\windows\syswow64\vidcap.ax" Heuristic match: "asp~1.net" Heuristic match: "tempor~1.net" Heuristic match: "c:\windows\system32\kswdmcap.ax" Heuristic match: "c:\windows\system32\msdvbnp.ax" Heuristic match: "c:\windows\system32\msnp.ax" Heuristic match: "fxsxp32.dllga-ieg711codc.ax" Heuristic match: "iac25_32.ax" Heuristic match: "ir41_32.ax" Heuristic match: "ivfsrc.ax" Heuristic match: "media.ba" Heuristic match: "user.exeusk.rs" Heuristic match: "vbicodec.ax" Heuristic match: "0aa7fb90e4b6e790c1d3fa19c35336d3c:\windows\syswow64\cero.rs" Heuristic match: "c:\windows\system32\web.rs"47:T59d,Found reference to API "ZwCreateMailslotF" (Indicator: "CreateMailslot"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "ZwCreateMailslotFi" (Indicator: "CreateMailslot"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "ZwCreateMailslotFil" (Indicator: "CreateMailslot"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "ZwCreateMailslotFile" (Indicator: "CreateMailslot"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "ZwCreateMailslotZwCrZwCre" (Indicator: "CreateMailslot"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "CreateMaCreateMaCreateMailslotA" (Indicator: "CreateMailslot"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "CreateMailslotA" (Indicator: "CreateMailslot"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "CreateMailslotW" (Indicator: "CreateMailslot"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") file/memory contains long string with (Indicator: "GetMailslotInfo"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "GetMailslotInfo" (Indicator: "GetMailslotInfo"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp")48:T669,Found registry query API: "RegOpenKey (in long string)" in file "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin" Found registry query API: "RegQueryValue (in long string)" in file "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin" Found registry query API: "RegNotifyChangeKeyValue (in long string)" in file "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin" Found registry query API: "RtlQueryRegistryValues" in "00000000-00000196.00000000.170481.00280000.00000004.mdmp" Found registry query API: "RtlQueryRegistryValuesE" in "00000000-00000196.00000000.170481.00280000.00000004.mdmp" Found registry query API: "RtlQueryRegistryValuesExRtlQueryResourceP" in "00000000-00000196.00000000.170481.00280000.00000004.mdmp" Found registry query API: "RtlpNtQueryValueKey" in "00000000-00000196.00000000.170481.00280000.00000004.mdmp" Found registry query API: "ZwEnumerateKey" in "00000000-00000196.00000000.170481.00280000.00000004.mdmp" Found registry query API: "ZwEnumerateValueKey" in "00000000-00000196.00000000.170481.00280000.00000004.mdmp" Found registry query API: "ZwQueryKey" in "00000000-00000196.00000000.170481.00280000.00000004.mdmp" Found registry query API: "ZwQueryValueKey" in "00000000-00000196.00000000.170481.00280000.00000004.mdmp" Found registry query API: "ZwSaveKeZwSaveKeyZZwZwS" in "00000000-00000196.00000000.170481.00280000.00000004.mdmp" Found registry query API: "ZwSaveKeyE" in "00000000-00000196.00000000.170481.00280000.00000004.mdmp" Found registry query API: "ZwSaveKeyEx" in "00000000-00000196.00000000.170481.00280000.00000004.mdmp"49:T71b,file/memory contains long string with (Indicator: "NetUserEnum"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "GetUserName"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "NetUserGetInfo"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "LookupAccountSid"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "WTSQueryUserToken"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "LookupAccountName"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "GetTokenInformation"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "NetGetJoinInformation"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "NtQuerySystemInformation"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "NtQueryInformationProcess"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00000196.00000000.170481.FD428000.00000002.mdmp") Found reference to API "NtQueryInformationToken" (Indicator: "NtQueryInformationToken"; Source: "00000000-00000196.00000000.170481.FD428000.00000002.mdmp")4a:T114f,Found string "chacha8" (Indicator: "chacha"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") Found string "*chacha8rand.State" (Indicator: "chacha"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") Found string "internal/chacha8rand" (Indicator: "chacha"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "aes"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "3des"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") Found string "internal/chacha8rand.(*State).Init" (Indicator: "chacha"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") Found string "internal/chacha8rand.(*State).Init64" (Indicator: "chacha"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") Found string "internal/chacha8rand.(*State).Refill" (Indicator: "chacha"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") Found string "internal/chacha8rand.(*State).Reseed" (Indicator: "chacha"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") Found string "internal/chacha8rand.(*State).Next" (Indicator: "chacha"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") Found string "type:.eq.internal/chacha8rand.State" (Indicator: "chacha"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") Found string "TnoYgpvND.(*V4aiPCJW).Encrypt" (Indicator: ".encrypt"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") Found string "BasepReleaseSxsCreateProcessUtilBasepSetFileEncryptionCompressioBeginUpdateResourceA" (Indicator: "fileencrypt"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") file/memory contains long string with (Indicator: "fileencrypt"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found string "System.IO.Compression.ZipFile.dll" (Indicator: "zipfile"; Source: "00000000-00000196.00000001.172092.00280000.00000004.mdmp, 00000000-00000196.00000001.172092.00400000.00000004.mdmp") Found string "System.Security.Cryptography.Algorithms.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000196.00000001.172092.00280000.00000004.mdmp, 00000000-00000196.00000001.172092.00400000.00000004.mdmp") Found string "System.Security.Cryptography.Csp.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000196.00000001.172092.00280000.00000004.mdmp, 00000000-00000196.00000001.172092.00400000.00000004.mdmp") Found string "System.Security.Cryptography.Encoding.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000196.00000001.172092.00280000.00000004.mdmp, 00000000-00000196.00000001.172092.00400000.00000004.mdmp") Found string "System.Security.Cryptography.Primitives.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000196.00000001.172092.00280000.00000004.mdmp, 00000000-00000196.00000001.172092.00400000.00000004.mdmp") Found string "System.Security.Cryptography.X509Certificates.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000196.00000001.172092.00280000.00000004.mdmp, 00000000-00000196.00000001.172092.00400000.00000004.mdmp") Found string "C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.IO.Compression.ZipFile.dll" (Indicator: "zipfile"; Source: "00000000-00000196.00000001.172092.00280000.00000004.mdmp, 00000000-00000196.00000001.172092.00400000.00000004.mdmp") Found string "C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Security.Cryptography.X509Certificates.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000196.00000001.172092.00400000.00000004.mdmp") Found string "??\C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Security.Cryptography.X509Certificates.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000196.00000001.172092.4E820000.00000004.mdmp") Found string ":\windows\microsoft.net\framework\v4.0.30319\system.security.cryptography.primitives.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000196.00000001.172092.4E820000.00000004.mdmp") Found string "chacha8" (Indicator: "chacha"; Source: "00000000-00000196.00000001.172092.57767000.00000002.mdmp")4b:T59d,Found reference to API "ZwCreateMailslotF" (Indicator: "CreateMailslot"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "ZwCreateMailslotFi" (Indicator: "CreateMailslot"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "ZwCreateMailslotFil" (Indicator: "CreateMailslot"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "ZwCreateMailslotFile" (Indicator: "CreateMailslot"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "ZwCreateMailslotZwCrZwCre" (Indicator: "CreateMailslot"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "CreateMaCreateMaCreateMailslotA" (Indicator: "CreateMailslot"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "CreateMailslotA" (Indicator: "CreateMailslot"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "CreateMailslotW" (Indicator: "CreateMailslot"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") file/memory contains long string with (Indicator: "GetMailslotInfo"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "GetMailslotInfo" (Indicator: "GetMailslotInfo"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp")4c:Ta80,file/memory contains long string with (Indicator: "FindNextFile"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "FindFirstFile"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") Found reference to API "FindActCtxSectionStringAFindActCtxSectionStringWFindFirstFileNameW" (Indicator: "FindFirstFile"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "FindFirstFileTransactedAFindFirstFileTransactedWFindNextFileNameW" (Indicator: "FindFirstFile"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "FindFirstFileTransactedAFindFirstFileTransactedWFindNextFileNameW" (Indicator: "FindNextFile"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "FindClosFindFirsFindCloseChangeNFindFirstChangeNFindFirsFindFirsFindFirstChangeNFindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "FindFirstFileNameTransactedW" (Indicator: "FindFirstFile"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "FindFirstFileNameW" (Indicator: "FindFirstFile"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "FindFirstFileTransactedA" (Indicator: "FindFirstFile"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "FindFirstFileTransactedW" (Indicator: "FindFirstFile"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "FindNextFileNameW" (Indicator: "FindNextFile"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "FindNextChangeNoFindNextFindNextFindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "FindNextFileNameFindNextFindNextFindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp")4d:T122a,Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "Thread32Next"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "EnumProcesses"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "Module32Next"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "Thread32First"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "Process32Next"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "Module32First"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "Process32First"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") Found reference to API "invalid g statuscastogscanstatusbad g transitionschedule: in cgoreflect mismatchmissing stackmapbad symbol tablepointerless typeGetCurrentThreadGetModuleHandleWRtlVirtualUnwind" (Indicator: "GetModuleHandle"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "GetCurrentProcess"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "EnumProcessModules"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "GetModuleHandle"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "GetEnvironmentStrings"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "CreateToolhelp32Snapshot"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "QueryInformationProcess"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") Found reference to API "RtlGetCriticalSectionRecursionCoRtlGetCurrentProcessorNum" (Indicator: "GetCurrentProcess"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlGetCurrentProcessorNumb" (Indicator: "GetCurrentProcess"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlGetCurrentProcessorNumbe" (Indicator: "GetCurrentProcess"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlGetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlGetCurrentProcessorNum" (Indicator: "GetCurrentProcess"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlGetCurrentProcessorNumberE" (Indicator: "GetCurrentProcess"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlGetCurrentProcessorNumberEx" (Indicator: "GetCurrentProcess"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlGetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlGetCurrentProcesso" (Indicator: "GetCurrentProcess"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlGetCurrentProcessor" (Indicator: "GetCurrentProcess"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlGetCurrentProcessorN" (Indicator: "GetCurrentProcess"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlGetCurrentProcessorNuRtlGetCurrentProc" (Indicator: "GetCurrentProcess"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlGetCurrentProcessorNuRtlGetCurrentServ" (Indicator: "GetCurrentProcess"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "ZwGetCompleteWnfStateSubscriptioZwGetCurrentProcessorNumb" (Indicator: "GetCurrentProcess"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp")4e:T43c,Found reference to API "invalid g statuscastogscanstatusbad g transitionschedule: in cgoreflect mismatchmissing stackmapbad symbol tablepointerless typeGetCurrentThreadGetModuleHandleWRtlVirtualUnwind" (Indicator: "GetModuleHandle"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "GetModuleHandle"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") Found reference to API "GetModuleHandleExA" (Indicator: "GetModuleHandle"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp, 00000000-00000196.00000000.170481.FD428000.00000002.mdmp") file/memory contains long string with (Indicator: "GetModuleHandle"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000196.00000000.170481.FD428000.00000002.mdmp")4f:T11af,Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "GetTempPath"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "GetFileAttributes"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "GetSystemDirectory"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "GetFileVersionInfo"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "GetCurrentDirectory"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "ReadDirectoryChange"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "QueryInformationFile"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "GetFileVersionInfoSize"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "GetFileInformationByHandle"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") Found reference to API "RtlGetCurrentDirectory" (Indicator: "GetCurrentDirectory"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlGetCurrentDirectory_" (Indicator: "GetCurrentDirectory"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlGetCurrentDirectory_URtlGetCurrentProc" (Indicator: "GetCurrentDirectory"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "ZwQueryAuxiliaryCounterFrequencyZwQueryFullAttributesFile" (Indicator: "QueryFullAttributesFile"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "ZwQueryAttributesFile" (Indicator: "QueryAttributesFile"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "ZwQueryInformationFile" (Indicator: "QueryInformationFile"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp, 00000000-00000196.00000000.170481.00380000.00000004.mdmp, 00000000-00000196.00000000.170481.FD428000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "GetFileAttributesExA" (Indicator: "GetFileAttributes"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp, 00000000-00000196.00000001.172092.00280000.00000004.mdmp, 00000000-00000196.00000001.172092.57767000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp, 00000000-00000196.00000000.170481.FD428000.00000002.mdmp, 00000000-00000196.00000001.172092.00280000.00000004.mdmp")50:T512,file/memory contains long string with (Indicator: "DeleteFile"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "RemoveDirectory"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") Found reference to API "ZwDeleteFile" (Indicator: "DeleteFile"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "DeleteFileTransactedA" (Indicator: "DeleteFile"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "DeleteFileTransactedW" (Indicator: "DeleteFile"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "DeleteFiDeleteFiDeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "DeleteFileTransaDeleteFiDeleteFiDeleteFileTransaDeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp")51:T1b83,file/memory contains long string with (Indicator: "CopySid"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "EqualSid"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "FreeSid"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "GetAce"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "IsValidSid"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "GetLengthSid"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "RevertToSelf"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "IsWellKnownSid"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "MakeAbsoluteSD"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "ImpersonateSelf"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "DuplicateToken"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "DuplicateTokenEx"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "SetEntriesInAcl"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "AdjustTokenGroups"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "IsTokenRestricted"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "CreateWellKnownSid"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "GetSidSubAuthority"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "MakeSelfRelativeSD"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "GetTokenInformation"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "SetTokenInformation"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "GetSidSubAuthorityCount"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "SetKernelObjectSecurity"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "ImpersonateLoggedOnUser"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "GetSecurityDescriptorSacl"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "GetSidIdentifierAuthority"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "IsValidSecurityDescriptor"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "SetSecurityDescriptorDacl"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "SetSecurityDescriptorSacl"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "GetSecurityDescriptorGroup"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "GetSecurityDescriptorOwner"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "SetSecurityDescriptorGroup"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "SetSecurityDescriptorOwner"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "GetSecurityDescriptorControl"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "InitializeSecurityDescriptor"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "SetSecurityDescriptorControl"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "GetSecurityDescriptorRMControl"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "SetSecurityDescriptorRMControl"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") Found reference to API "RtlCopySecurityDescriptoRtlCopySidAndAttr" (Indicator: "CopySid"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlCopySidAndAttri" (Indicator: "CopySid"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlCopySidAndAttrib" (Indicator: "CopySid"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlCopySidAndAttribu" (Indicator: "CopySid"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlCopySidAndAttribut" (Indicator: "CopySid"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlCopySidAndAttribute" (Indicator: "CopySid"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlCopySidAndAttributes" (Indicator: "CopySid"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlCopySidAndAttributesARtlCopyUnicodeStr" (Indicator: "CopySid"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlCopySid" (Indicator: "CopySid"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "RtlCopySidA" (Indicator: "CopySid"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp")52:T48e,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "ExitProcess"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") Found reference to API "ZwTerminateProcess" (Indicator: "ZwTerminateProcess"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "ZwTerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "EscapeCommFunctiExecuteUExitProcExecuteUmsThreadExecuteUmsThreadExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp, 00000000-00000196.00000000.170481.FD428000.00000002.mdmp, 00000000-00000196.00000001.172092.57767000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00000196.00000000.170481.FD428000.00000002.mdmp")53:T9ce,"rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000009"; Key: "PACKEDCATALOGITEM"; Value: "")54:Te53,file/memory contains long string with (Indicator: "OpenMutex"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "CreateMutex"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") file/memory contains long string with (Indicator: "ReleaseMutex"; File: "3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin") Found reference to API "TpCallbackReleaseMutexOnCompletio" (Indicator: "ReleaseMutex"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "TpCallbackReleaseMutexOnCompletion" (Indicator: "ReleaseMutex"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "TpCallbackLeaveCriticalSectionOnTpCallbackReleaseMutexOnC" (Indicator: "ReleaseMutex"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "TpCallbackReleaseMutexOnCo" (Indicator: "ReleaseMutex"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "TpCallbackReleaseMutexOnCom" (Indicator: "ReleaseMutex"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "TpCallbackReleaseMutexOnComp" (Indicator: "ReleaseMutex"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "TpCallbackReleaseMutexOnCompl" (Indicator: "ReleaseMutex"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "TpCallbackReleaseMutexOnComple" (Indicator: "ReleaseMutex"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "TpCallbackReleaseMutexOnComplet" (Indicator: "ReleaseMutex"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "TpCallbackReleaseMutexOnCompletiTpCallbackReleaseSemaphor" (Indicator: "ReleaseMutex"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "TpCallbackReleaseMutex" (Indicator: "ReleaseMutex"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "TpCallbackReleaseMutexO" (Indicator: "ReleaseMutex"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "TpCallbackReleaseMutexOnTpCallbackRelease" (Indicator: "ReleaseMutex"; Source: "00000000-00000196.00000000.170481.00280000.00000004.mdmp") Found reference to API "CreateMeCreateMuCreateMemoryResoCreateMutexA" (Indicator: "CreateMutex"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "CreateMutexA" (Indicator: "CreateMutex"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "CreateMuCreateMuCreateMutexExA" (Indicator: "CreateMutex"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "CreateMutexExA" (Indicator: "CreateMutex"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "CreateMutexExW" (Indicator: "CreateMutex"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp, 00000000-00000196.00000000.170481.FD428000.00000002.mdmp") Found reference to API "CreateMuCreateNaCreateMutexW" (Indicator: "CreateMutex"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; Source: "00000000-00000196.00000000.170481.00380000.00000004.mdmp") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; Source: "00000000-00000196.00000000.170481.FD428000.00000002.mdmp")55:T5cd,"C:\Windows\System32\AuthHost.exe" (Indicator: "authhost.exe") "C:\Windows\System32\ByteCodeGenerator.exe" (Indicator: "bytecodegenerator.exe") "ThumbnailExtractionHost.exe" (Indicator: "thumbnailextractionhost.exe") "TieringEngineService.exeTileDataRepository.dll" (Indicator: "tieringengineservice.exe") "UserAccountBroker.exe" (Indicator: "useraccountbroker.exe") "WallpaperHost.exe" (Indicator: "wallpaperhost.exe") "tpmvscmgr.exe" (Indicator: "tpmvscmgr.exe") "tpmvscmgrsvr.exetquery.dll" (Indicator: "tpmvscmgrsvr.exe") "tzsync.exe" (Indicator: "tzsync.exe") "wkspbroker.exe" (Indicator: "wkspbroker.exe") "WWAHost.exe" (Indicator: "wwahost.exe") "WWAHost.exei" (Indicator: "wwahost.exe") "BackgroundTransferHost.exe" (Indicator: "backgroundtransferhost.exe") "immersivetpmvscmgrsvr.exe" (Indicator: "immersivetpmvscmgrsvr.exe") "AuthFWSnapin.dllAuthFWWizFwk.dllAuthHost.exe" (Indicator: "authhost.exe") "bootim.exe" (Indicator: "bootim.exe") "changepk.exe" (Indicator: "changepk.exe") "backgroundTaskHost.exe" (Indicator: "backgroundtaskhost.exe") "ByteCodeGenerator.exe" (Indicator: "bytecodegenerator.exe") "CheckNetIsolation.exe" (Indicator: "checknetisolation.exe") "CredentialUIBroker.exe" (Indicator: "credentialuibroker.exe") "EaseOfAccessDialog.exe" (Indicator: "easeofaccessdialog.exe") "licensingdiag.exe" (Indicator: "licensingdiag.exe") "MsSpellCheckingHost.exe" (Indicator: "msspellcheckinghost.exe") "dasHost.exe" (Indicator: "dashost.exe")56:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC57:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC58:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":57,"unified_at_epoch_ms":1791316983029,"unified_at":"2026-10-06T20:03:03.029Z","metadata":{"hashes":{"sha256":"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2","sha1":"7e65f7901aa4586c24bde6fe7bda5ce85418adca","md5":"42954d188d8ed2cf8c9e1f20c36baffd","sha512":"1c2647f0adf4d9771e76ddfaa332c5b8860e1006a7cdcb79886ebbe98d59d8d8fb30c2ddac658dabdfa8e5c89020960a10ff58f103960460a860d66507ea4ade","ssdeep":"49152:k2i6oxMcTe5mFjZQzJs7mOukEr69AriPp7qCuu39p+jPJjYQcQ7s7:k2o7EggPjq","ssdeep_chunks":["49152:k2i6oxM","49152:2i6oxMc","49152:i6oxMcT","49152:6oxMcTe","49152:oxMcTe5","49152:xMcTe5m","49152:McTe5mF","49152:cTe5mFj","49152:Te5mFjZ","49152:e5mFjZQ","49152:5mFjZQz","49152:mFjZQzJ","49152:FjZQzJs","49152:jZQzJs7","49152:ZQzJs7m","49152:QzJs7mO","49152:zJs7mOu","49152:Js7mOuk","49152:s7mOukE","49152:7mOukEr","49152:mOukEr6","49152:OukEr69","49152:ukEr69A","49152:kEr69Ar","49152:Er69Ari","49152:r69AriP","49152:69AriPp","49152:9AriPp7","49152:AriPp7q","49152:riPp7qC","49152:iPp7qCu","49152:Pp7qCuu","49152:p7qCuu3","49152:7qCuu39","49152:qCuu39p","49152:Cuu39p+","49152:uu39p+j","49152:u39p+jP","49152:39p+jPJ","49152:9p+jPJj","49152:p+jPJjY","49152:+jPJjYQ","49152:jPJjYQc","49152:PJjYQcQ","49152:JjYQcQ7","49152:jYQcQ7s","49152:YQcQ7s7","98304:k2i6oxM","98304:2i6oxMc","98304:i6oxMcT","98304:6oxMcTe","98304:oxMcTe5","98304:xMcTe5m","98304:McTe5mF","98304:cTe5mFj","98304:Te5mFjZ","98304:e5mFjZQ","98304:5mFjZQz","98304:mFjZQzJ","98304:FjZQzJs","98304:jZQzJs7","98304:ZQzJs7m","98304:QzJs7mO","98304:zJs7mOu","98304:Js7mOuk","98304:s7mOukE","98304:7mOukEr","98304:mOukEr6","98304:OukEr69","98304:ukEr69A","98304:kEr69Ar","98304:Er69Ari","98304:r69AriP","98304:69AriPp","98304:9AriPp7","98304:AriPp7q","98304:riPp7qC","98304:iPp7qCu","98304:Pp7qCuu","98304:p7qCuu3","98304:7qCuu39","98304:qCuu39p","98304:Cuu39p+","98304:uu39p+j","98304:u39p+jP","98304:39p+jPJ","98304:9p+jPJj","98304:p+jPJjY","98304:+jPJjYQ","98304:jPJjYQc","98304:PJjYQcQ","98304:JjYQcQ7","98304:jYQcQ7s","98304:YQcQ7s7","49152:k2o7Egg","49152:2o7EggP","49152:o7EggPj","49152:7EggPjq"],"imphash":"22e59ac5cab9839fda1ed6b8c9f8e6bb"},"file_info":{"file_name":"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin","file_type":["pedll","64bits","executable"],"file_type_id":"64-bit dll","file_size":4276752,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1776630028000,"last_seen":1776667142000,"last_multi_scan":1776667142000}},"detections":{"summary":{"verdict":"malicious","score":57,"tags":["windows-server-utility"]},"stats":{"av":{"malicious_count":3,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":87},"sandbox_signatures":{"informative_count":211,"suspicious_count":9,"malicious_count":1,"total":221},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Trojan_Win32_Wacatac_B_ml","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/W64.Loader.k!crit","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan_Win32_Wacatac_B_ml","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Able to use GrayString API for text rendering"},{"type":"informative","value":"Contains ability to create new processes (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to create/read/set mailslotinfo (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Able to access mailslot-related API (String)"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"},{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Persistence","technique":"Local Account","attack_id":"T1136.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1136/001","identifiers":[{"type":"informative","value":"Contains ability to create a new user account (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create a service (API string)"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to set/delete MS-DOS device name (API string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Able to unregister service from Service Control Manager"},{"type":"informative","value":"Contains ability to modify system service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Persistence","technique":"Office Application Startup","attack_id":"T1137","attack_id_wiki":"https://attack.mitre.org/techniques/T1137","identifiers":[{"type":"informative","value":"Contains reference to messaging system library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to create a remote thread (API string)"},{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Privilege Escalation","technique":"Bypass User Account Control","attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Contains ability to bypass UAC using COM object (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Privilege Escalation","technique":"Process Doppelgänging","attack_id":"T1055.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/013","identifiers":[{"type":"informative","value":"Contains ability to perform Process Doppelganging (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"informative","value":"Contains ability to unmap view of a section from a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","identifiers":[{"type":"suspicious","value":"Found TLS callbacks"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"YARA signature match - ChaCha20 encryption algorithm"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"},{"type":"informative","value":"Spawns Windows crash diagnostic and reporting process"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Contains ability to enumerate volumes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Contains ability to retrieve information set for devices (API string)"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect presence of virtual environment (API string)"},{"type":"informative","value":"Able to detect virtual machine (string)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"The input sample contains the RDTSCP instruction"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to modify process attributes (API string)"},{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"},{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Defense Evasion","technique":"NTFS File Attributes","attack_id":"T1564.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/004","identifiers":[{"type":"informative","value":"Contains ability to query/modify extended-attribute values of a file (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Defense Evasion","technique":"Rundll32","attack_id":"T1218.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1218/011","identifiers":[{"type":"informative","value":"Executes a DLL using Rundll32 process"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"malicious","value":"The input sample is signed with an invalid certificate"},{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Credential Access","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"informative","value":"Contains ability to register/read input devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"},{"type":"informative","value":"Strings related to file managers detected"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Contains ability to retrieve system network configuration"},{"type":"informative","value":"Contains ability to query network adapter information (API string)"},{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"},{"type":"informative","value":"Contains ability retrieve IPv4 mapping information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Able to find string content in a file"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Contains ability to retrieve information about MS-DOS device names (API string)"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Contains ability to open handle to a named event object (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to enumerate running processes using Tasklist"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about user accounts on a server (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Monitors specific registry key for changes"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"},{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Able to query service configuration on system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Contains ability to retrieve remote session information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"suspicious","value":"Able to retrieve local network connections"},{"type":"informative","value":"Contains ability to enumerate logon sessions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"References Windows LDAP client module"},{"type":"informative","value":"Able to enumerate permission groups in the domain"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Discovery","technique":"Domain Trust Discovery","attack_id":"T1482","attack_id_wiki":"https://attack.mitre.org/techniques/T1482","identifiers":[{"type":"informative","value":"Contains ability to enumerate trusted domains"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1021.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/001","identifiers":[{"type":"informative","value":"Contains ability to perform remote desktop activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Able to modify Remote Configuration"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Contains ability to compress/decompress buffers (API string)"},{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Collection","technique":"Data from Removable Media","attack_id":"T1025","attack_id_wiki":"https://attack.mitre.org/techniques/T1025","identifiers":[{"type":"informative","value":"Able to retrieve system driver type"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Able to perform SQL operations"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to change the configuration parameters of a service"},{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"},{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Impact","technique":"Account Access Removal","attack_id":"T1531","attack_id_wiki":"https://attack.mitre.org/techniques/T1531","identifiers":[{"type":"informative","value":"Contains ability to delete a user account from a server (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains possible references to Golang crypto modules"},{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Able to access crypto-related API (String)"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"tactic":"Impact","technique":"Data Destruction","attack_id":"T1485","attack_id_wiki":"https://attack.mitre.org/techniques/T1485","identifiers":[{"type":"informative","value":"Contains ability to delete device information set (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"clrcompression.dll\" (Source: \"00000000-00000196.00000001.172092.00280000.00000004.mdmp, 00000000-00000196.00000001.172092.00400000.00000004.mdmp\")\n Found string \"System.IO.Compression.ZipFile.dll\" (Source: \"00000000-00000196.00000001.172092.00280000.00000004.mdmp, 00000000-00000196.00000001.172092.00400000.00000004.mdmp\")\n Found string \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\System.IO.Compression.ZipFile.dll\" (Source: \"00000000-00000196.00000001.172092.00280000.00000004.mdmp, 00000000-00000196.00000001.172092.00400000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to enumerate permission groups in the domain","description":"file/memory contains long string with (Indicator: \"netusergetlocalgroups\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-981","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n file/memory contains long string with (Indicator: \"OpenThread\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n file/memory contains long string with (Indicator: \"ResumeThread\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to unregister service from Service Control Manager","description":"file/memory contains long string(File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-690","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to compress/decompress buffers (API string)","description":"Found reference to API \"RtlCompleteProcessCloninRtlCompressBuffer\" (Indicator: \"RtlCompressBuffer\"; Source: \"00000000-00000196.00000000.170481.00280000.00000004.mdmp\")\n Found reference to API \"RtlDecompressBuffer\" (Indicator: \"RtlDecompressBuffer\"; Source: \"00000000-00000196.00000000.170481.00280000.00000004.mdmp\")\n Found reference to API \"RtlDecompressBufferE\" (Indicator: \"RtlDecompressBuffer\"; Source: \"00000000-00000196.00000000.170481.00280000.00000004.mdmp\")\n Found reference to API \"RtlDecompressBufferEx\" (Indicator: \"RtlDecompressBuffer\"; Source: \"00000000-00000196.00000000.170481.00280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-404","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to create a remote thread (API string)","description":"Found reference to API \"RtlCreateUserThread\" (Indicator: \"RtlCreateUserThread\"; Source: \"00000000-00000196.00000000.170481.00280000.00000004.mdmp\")\n Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")\n Found reference to API \"CreateRemoteThreadEx\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to detect presence of virtual environment (API string)","description":"file/memory contains long string with (Indicator: \"SetupDiEnumDeviceInfo\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n file/memory contains long string with (Indicator: \"SetupDiGetClassDevs\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n file/memory contains long string with (Indicator: \"SetupDiGetDeviceRegistryProperty\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-253","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"ZwSetValueKey\" (Indicator: \"ZwSetValueKey\"; Source: \"00000000-00000196.00000000.170481.00280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify system service (API string)","description":"file/memory contains long string with (Indicator: \"ControlService\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n file/memory contains long string with (Indicator: \"ChangeServiceConfig\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"file/memory contains long string with (Indicator: \"OpenService\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"file/memory contains long string with (Indicator: \"SetFileTime\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"ZwUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00000196.00000000.170481.00280000.00000004.mdmp\")\n Found reference to API \"ZwUnmapViewOfSectionE\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00000196.00000000.170481.00280000.00000004.mdmp\")\n Found reference to API \"ZwUnmapViewOfSectionEx\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00000196.00000000.170481.00280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \"amsi.dllapds.dllamsiproxy.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00000196.00000000.170481.00380000.00000004.mdmp\n 00000000-00000196.00000001.172092.00280000.00000004.mdmp\n Observed string: \"C:\\Windows\\SysWOW64\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00000196.00000001.172092.00280000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - no deferreturnbad restart PCstopm spinningrandinit twicestore64 failedsemaRoot queuebad allocCountbad span statestack overflowno module dataunsafe.Pointer on zero Valueunknown methodcrypto/fips140mime/multipartx509sha256skidunknown dsbyte\\\\.\\C3G64G55_hnLMASBWX-J0B93L6GHVNWRS-EMQO7UAadvertise errorkey has expirednetwork is downno medium foundno such processGetAdaptersInfoCreateHardLinkWDeviceIoControlDuplicateHandleFlushViewOfFileGetCommandLineWGetProcessTimesGetStartupInfoWProcess32FirstWUnmapViewOfFile; Source: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2b","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Spawns Windows crash diagnostic and reporting process","description":"Process \"WerFault.exe\" [UID: 00000000-00007244]\n Process \"WerFault.exe\" [UID: 00000000-00002076]\n Process \"WerFault.exe\" [UID: 00000000-00004844]\n Process \"WerFault.exe\" [UID: 00000000-00001052]","origin":"Monitored Target","mitre_attack_id":"T1564","relevance":1,"id":"target-585","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"file/memory contains long string with (Indicator: \"GetTickCount\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n file/memory contains long string with (Indicator: \"NtQueryInformationProcess\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"file/memory contains long string with (Indicator: \"CryptProtectData\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n file/memory contains long string with (Indicator: \"CryptUnprotectData\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"file/memory contains long string with (Indicator: \"CryptUnprotectData\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"file/memory contains long string with (Indicator: \"CryptProtectData\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains possible references to Golang crypto modules","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-234","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains possible references to Golang crypto modules\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Contains ability to perform encryption (API string)\n Matched sigs: Able to access crypto-related API (String)\n Matched sigs: Contains ability to perform decryption (API string)\n Matched sigs: YARA signature match - ChaCha20 encryption algorithm\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2f","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to detect virtual machine (string)","description":"Found string \"C:\\Windows\\System32\\VBoxOGL.dll\" (Source: \"00000000-00000196.00000001.172092.00500000.00000004.mdmp\")\n Found string \"C:\\Windows\\System32\\VBoxD3D9wddm.dll\" (Source: \"00000000-00000196.00000001.172092.00500000.00000004.mdmp\")\n Found string \"C:\\Windows\\System32\\VBoxOGLarrayspu.dll\" (Source: \"00000000-00000196.00000001.172092.00500000.00000004.mdmp\")\n Found string \"C:\\Windows\\System32\\VBoxOGLcrutil.dll\" (Source: \"00000000-00000196.00000001.172092.00500000.00000004.mdmp\")\n Found string \"C:\\Windows\\System32\\VBoxOGLerrorspu.dll\" (Source: \"00000000-00000196.00000001.172092.00500000.00000004.mdmp\")\n Found string \"C:\\Windows\\System32\\VBoxOGLfeedbackspu.dll\" (Source: \"00000000-00000196.00000001.172092.00500000.00000004.mdmp\")\n Found string \"C:\\Windows\\System32\\VBoxOGLpackspu.dll\" (Source: \"00000000-00000196.00000001.172092.00500000.00000004.mdmp\")\n Found string \"C:\\Windows\\System32\\VBoxOGLpassthroughspu.dll\" (Source: \"00000000-00000196.00000001.172092.00500000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-989","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"file/memory contains long string with (Indicator: \"NtQuerySystemInformation\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n Found reference to API \"ZwQuerySystemInformationE\" (Indicator: \"ZwQuerySystemInformation\"; Source: \"00000000-00000196.00000000.170481.00280000.00000004.mdmp\")\n Found reference to API \"ZwQuerySystemInformationEx\" (Indicator: \"ZwQuerySystemInformation\"; Source: \"00000000-00000196.00000000.170481.00280000.00000004.mdmp\")\n Found reference to API \"ZwQuerySystemInformationZwQuerySystemInfo\" (Indicator: \"ZwQuerySystemInformation\"; Source: \"00000000-00000196.00000000.170481.00280000.00000004.mdmp\")\n Found reference to API \"ZwQuerySystemInformationZwQuerySystemTime\" (Indicator: \"ZwQuerySystemInformation\"; Source: \"00000000-00000196.00000000.170481.00280000.00000004.mdmp\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00000196.00000000.170481.FD428000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to find string content in a file","description":"Found string \"findstr.exe\" (Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp, 00000000-00000196.00000001.172092.00280000.00000004.mdmp, 00000000-00000196.00000001.172092.00400000.00000004.mdmp\")\n Found string \"C:\\Windows\\SysWOW64\\findstr.exe\" (Source: \"00000000-00000196.00000001.172092.00280000.00000004.mdmp\")\n Found string \"C:\\Windows\\System32\\findstr.exe\" (Source: \"00000000-00000196.00000001.172092.00280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-688","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"file/memory contains long string(Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"file/memory contains long string with (Indicator: \"NtQuerySystemInformation\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n Found string \"EnumSystemFirmwareTables\" (Indicator: \"EnumSystemFirmwareTables\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00000196.00000000.170481.FD428000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000196-00000C2C-1631519722\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")\n Found string \"GetCommaGetComprGetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp, 00000000-00000196.00000000.170481.FD428000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"file/memory contains long string with (Indicator: \"WTSFreeMemory\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n file/memory contains long string with (Indicator: \"ProcessIdToSessionId\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n file/memory contains long string with (Indicator: \"WTSEnumerateSessions\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"file/memory contains long string with (Indicator: \"FreeSid\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n file/memory contains long string with (Indicator: \"CheckTokenMembership\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n Found reference to API \"RtlFreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00000196.00000000.170481.00280000.00000004.mdmp\")\n Found reference to API \"CheckTokenMembershipEx\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"file/memory contains long string(File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"file/memory contains long string with (Indicator: \"getaddrinfo\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n Found reference to API \"GetFullPGetFullPGetFullPathNameAGetFullPathNameAGetFullPathNameTGetFullPGetFullPGetFullPathNameTGetFullPathNameWGetFullPathNameWGetGeoInGetGeoInGetGeoInfoA\" (Indicator: \"getgeoinfo\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")\n Found reference to API \"GetGeoInfoA\" (Indicator: \"getgeoinfo\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")\n Found reference to API \"GetGeoInfoEx\" (Indicator: \"getgeoinfo\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")\n Found reference to API \"GetGeoInGetHandlGetGeoInfoW\" (Indicator: \"getgeoinfo\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")\n Found reference to API \"GetGeoInfoW\" (Indicator: \"getgeoinfo\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system driver type","description":"Found string \"driverquery.exe\" (Indicator: \"driverquery\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp, 00000000-00000196.00000001.172092.00280000.00000004.mdmp\")\n Found string \"C:\\Windows\\SysWOW64\\driverquery.exe\" (Indicator: \"driverquery\"; Source: \"00000000-00000196.00000001.172092.00280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1025","relevance":1,"id":"string-713","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"file/memory contains long string with (Indicator: \"GetKeyboardLayout\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"file/memory contains long string with (Indicator: \"enumwindows\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n file/memory contains long string with (Indicator: \"enumchildwindows\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n Found reference to API \"GetSendMGetShellGetSendMessageReGetShellWindow\" (Indicator: \"sendmessage\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")\n Found reference to API \"ImpersonateDdeClInSendMeInSendMeInSendMessage\" (Indicator: \"sendmessage\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")\n Found reference to API \"InSendMessage\" (Indicator: \"sendmessage\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")\n Found reference to API \"InSendMessageEx\" (Indicator: \"sendmessage\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"rundll32.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00000196)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"rundll32.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00000196)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"rundll32.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00000196)\n \"rundll32.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00003672)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00000196)\n \"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003672)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$34","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"file/memory contains long string with (Indicator: \"IsWow64Process\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00000196.00000000.170481.FD428000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate volumes (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1006","relevance":1,"id":"string-194","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"rundll32.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"file/memory contains long string with (Indicator: \"GetFileTime\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n file/memory contains long string with (Indicator: \"GetSystemTimeAsFileTime\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n Found reference to API \"FileTimeToLocalFileTime\" (Indicator: \"FileTimeToLocalFileTime\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")\n Found reference to API \"GetFileTime\" (Indicator: \"GetFileTime\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00000196.00000000.170481.FD428000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information set for devices (API string)","description":"file/memory contains long string with (Indicator: \"SetupDiEnumDeviceInfo\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n file/memory contains long string with (Indicator: \"SetupDiGetClassDevs\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n file/memory contains long string with (Indicator: \"SetupDiGetDeviceRegistryProperty\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")","origin":"File/Memory","mitre_attack_id":"T1480","relevance":1,"id":"string-533","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"file/memory contains long string with (Indicator: \"GetTimeZoneInformation\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n Found reference to API \"GetDynamicTimeZoneInformation\" (Indicator: \"GetDynamicTimeZoneInformation\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"file/memory contains long string with (Indicator: \"EnumWindows\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n file/memory contains long string with (Indicator: \"GetForegroundWindow\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n Found reference to API \"GetWindoGetWindoGetWindowTextA\" (Indicator: \"GetWindowText\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")\n Found reference to API \"GetWindowTextA\" (Indicator: \"GetWindowText\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")\n Found reference to API \"GetWindowTextLenGetWindoGetWindoGetWindowTextLenGetWindowTextW\" (Indicator: \"GetWindowText\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")\n Found reference to API \"GetWindowTextW\" (Indicator: \"GetWindowText\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"file/memory contains long string with (Indicator: \"GetWindowsDirectory\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system network configuration","description":"Found string \"RtlQueryProcessBackTraceRtlQueryProcessDe\" (Indicator: \"tracert\"; Source: \"00000000-00000196.00000000.170481.00280000.00000004.mdmp\")\n Found string \"RtlTraceRtlTraceDRRtRtl\" (Indicator: \"tracert\"; Source: \"00000000-00000196.00000000.170481.00280000.00000004.mdmp\")\n Found string \"TRACERT.EXE\" (Indicator: \"tracert\"; Source: \"00000000-00000196.00000000.170481.00280000.00000004.mdmp, 00000000-00000196.00000001.172092.00280000.00000004.mdmp\")\n Found string \"nsisvc.dllnso-ZAnslookup.exe\" (Indicator: \"nslookup\"; Source: \"00000000-00000196.00000000.170481.00400000.00000004.mdmp, 00000000-00000196.00000001.172092.00400000.00000004.mdmp\")\n Found string \"nslookup.exe\" (Indicator: \"nslookup\"; Source: \"00000000-00000196.00000001.172092.00280000.00000004.mdmp\")\n Found string \"C:\\Windows\\System32\\TRACERT.EXE\" (Indicator: \"tracert\"; Source: \"00000000-00000196.00000001.172092.00500000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-430","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"file/memory contains long string with (Indicator: \"GetVersion\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00000196.00000000.170481.00280000.00000004.mdmp\")\n Found reference to API \"RtlVerifyVersionInfo\" (Indicator: \"VerifyVersionInfo\"; Source: \"00000000-00000196.00000000.170481.00280000.00000004.mdmp\")\n Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; Source: \"00000000-00000196.00000000.170481.00280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"file/memory contains long string with (Indicator: \"GetStartupInfo\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"file/memory contains long string with (Indicator: \"GetVolumeInformation\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n file/memory contains long string with (Indicator: \"GetVolumePathNamesForVolumeName\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n file/memory contains long string with (Indicator: \"GetVolumeNameForVolumeMountPoint\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n Found reference to API \"ZwQueryVolumeInformationFile\" (Indicator: \"ZwQueryVolumeInformationFile\"; Source: \"00000000-00000196.00000000.170481.00280000.00000004.mdmp\")\n Found reference to API \"GetVolumeInformationByHandleW\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp, 00000000-00000196.00000001.172092.00280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to set LDT entries (API string)","description":"Found reference to API \"ZwSetLdtEntries\" (Indicator: \"SetLdtEntries\"; Source: \"00000000-00000196.00000000.170481.00280000.00000004.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-542","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"rundll32.exe\" queries volume information of \"C:\\Windows\\System32\" at 00000000-00000196-00000C17-1631743054\n \"rundll32.exe\" queries volume information of \"C:\\Windows\\SysWOW64\" at 00000000-00000196-00000C17-1645667218\n \"rundll32.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\" at 00000000-00000196-00000C17-1653910312\n \"rundll32.exe\" queries volume information of \"C:\\Windows\\System32\" at 00000000-00000196-00000C17-1655048338","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"file/memory contains long string with (Indicator: \"OpenSCManager\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n file/memory contains long string with (Indicator: \"QueryServiceStatus\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n file/memory contains long string with (Indicator: \"EnumServicesStatus\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n file/memory contains long string with (Indicator: \"EnumDependentServices\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFileW\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n file/memory contains long string with (Indicator: \"MoveFileExW\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLineA\" (Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")\n Found string \"GetCommaGetComprGetCommandLineW\" (Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp, 00000000-00000196.00000000.170481.FD428000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"RtlGetProcessHeap\" (Indicator: \"RtlGetProcessHeap\"; Source: \"00000000-00000196.00000000.170481.00280000.00000004.mdmp\")\n Found reference to API \"RtlGetProcessHeaps\" (Indicator: \"RtlGetProcessHeaps\"; Source: \"00000000-00000196.00000000.170481.00280000.00000004.mdmp\")\n Found reference to API \"ZwOpenProcess\" (Indicator: \"ZwOpenProcess\"; Source: \"00000000-00000196.00000000.170481.00280000.00000004.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp, 00000000-00000196.00000000.170481.FD428000.00000002.mdmp\")\n Found reference to API \"GetProcessHeaps\" (Indicator: \"GetProcessHeaps\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"General","name":"Able to use GrayString API for text rendering","description":"Found reference to API \"GhostWinGrayStriGhostWindowFromHGrayStringA\" (Indicator: \"GrayStringA\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")\n Found reference to API \"GrayStringA\" (Indicator: \"GrayStringA\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")\n Found reference to API \"GrayStriHandleDeGrayStringW\" (Indicator: \"GrayStringW\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")\n Found reference to API \"GrayStringW\" (Indicator: \"GrayStringW\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-900","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"svchost.exe\"\n Report process \"WerFault.exe\" was created by \"rundll32.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$39","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$3a","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"file/memory contains long string with (Indicator: \"CloseServiceHandle\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"General","name":"Contains ability to create a new user account (API string)","description":"file/memory contains long string with (Indicator: \"NetUserAdd\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")","origin":"File/Memory","mitre_attack_id":"T1136.001","relevance":1,"id":"string-214","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"General","name":"Contains ability to create new processes (API string)","description":"Found reference to API \"CreateProcessInternalA\" (Indicator: \"CreateProcessInternal\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")\n Found reference to API \"CreateProcessInternalW\" (Indicator: \"CreateProcessInternal\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-425","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"file/memory contains long string with (Indicator: \"RegCloseKey\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"file/memory contains long string with (Indicator: \"ShellExecute\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"file/memory contains long string with (Indicator: \"LogonUser\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFile\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"General","name":"Contains ability to open handle to a named event object (API string)","description":"Found reference to API \"ZwOpenEvent\" (Indicator: \"ZwOpenEvent\"; Source: \"00000000-00000196.00000000.170481.00280000.00000004.mdmp\")\n Found reference to API \"ZwOpenEventP\" (Indicator: \"ZwOpenEvent\"; Source: \"00000000-00000196.00000000.170481.00280000.00000004.mdmp\")\n Found reference to API \"ZwOpenEventPa\" (Indicator: \"ZwOpenEvent\"; Source: \"00000000-00000196.00000000.170481.00280000.00000004.mdmp\")\n Found reference to API \"ZwOpenEventPai\" (Indicator: \"ZwOpenEvent\"; Source: \"00000000-00000196.00000000.170481.00280000.00000004.mdmp\")\n Found reference to API \"ZwOpenEventPair\" (Indicator: \"ZwOpenEvent\"; Source: \"00000000-00000196.00000000.170481.00280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-467","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"General","name":"Contains ability to query/modify extended-attribute values of a file (API string)","description":"Found reference to API \"ZwQueryEaFile\" (Indicator: \"ZwQueryEaFile\"; Source: \"00000000-00000196.00000000.170481.00280000.00000004.mdmp\")\n Found reference to API \"ZwSetEaFile\" (Indicator: \"ZwSetEaFile\"; Source: \"00000000-00000196.00000000.170481.00280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.004","relevance":1,"id":"string-268","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n file/memory contains long string with (Indicator: \"CommandLineToArgv\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")\n Found reference to API \"GetCommaGetComprGetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp, 00000000-00000196.00000000.170481.FD428000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n file/memory contains long string with (Indicator: \"GetLastError\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n Found reference to API \"GetHandleInformaGetLargeGetLargeGetLargePageMiniGetLargestConsolGetLastEGetLocalGetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp, 00000000-00000196.00000000.170481.FD428000.00000002.mdmp, 00000000-00000196.00000001.172092.57767000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00000196.00000000.170481.FD428000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"file/memory contains long string with (Indicator: \"GetShellWindow\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n file/memory contains long string with (Indicator: \"GetWindowThreadProcessId\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n Found reference to API \"GetSendMGetShellGetSendMessageReGetShellWindow\" (Indicator: \"GetShellWindow\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")\n Found reference to API \"GetShellWindow\" (Indicator: \"GetShellWindow\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"file/memory contains long string with (Indicator: \"StartService\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"\"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\" contains export function called \"ServiceMain\" at ordinal 1\n \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\" contains export function called \"UvQsEWLooVQaDyMJT\" at ordinal 2","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"General","name":"Contains reference to messaging system library (API string)","description":"Found string \"mapi32.dll\" (Indicator: \"MAPI32.dll\"; Source: \"00000000-00000196.00000000.170481.00400000.00000004.mdmp, 00000000-00000196.00000001.172092.00280000.00000004.mdmp, 00000000-00000196.00000001.172092.00400000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1137","relevance":1,"id":"string-571","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"General","name":"Executes a DLL using Rundll32 process","description":"Process \"rundll32.exe\" with commandline \"\"C:\\\\3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin.dll\",#1\" (UID: 00000000-00000196)\n Process \"rundll32.exe\" with commandline \"\"C:\\\\3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin.dll\",#2\" (UID: 00000000-00003672)","origin":"Monitored Target","mitre_attack_id":"T1218.011","relevance":1,"id":"target-400","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"bitlockertoastimage.png@edptoastimage.png\"\n Pattern match: \"enrollmenttoasticon.png@notifiertoasticon.png\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" in Source: 00000000-00003672.00000000.170484.00080000.00000004.mdmp\n \"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\" in Source: 00000000-00003672.00000000.170484.00080000.00000004.mdmp","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$41","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"rundll32.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 83B70000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"rundll32.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 86FA0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\" has an writable section named \".data\"\n \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\" has an writable section named \".tls\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\" file has an entrypoint instructions - \"push\trdi,push\trsi,push\trbx,sub\trsp, 0x30,mov\trbx, rcx,mov\trsi, r8,cmp\tedx, 1,je\t0x180001278,mov\trdi, qword ptr [rip + 0x215e67],mov\tdword ptr [rdi], edx,test\tedx, edx,jne\t0x1800012e0,mov\teax, dword ptr [rip + 0x3fceef],test\teax, eax,jle\t0x180001270,mov\tdword ptr [rsp + 0x58], edx,xor\tedx, edx,call\t0x1802157b0,mov\tr9d, dword ptr [rsp + 0x58],mov\tr8, rsi,mov\tedx, r9d,mov\trcx, rbx,call\t0x180001000,mov\tr10d, eax,mov\teax, r10d,mov\tdword ptr [rdi], 0xffffffff,add\trsp, 0x30,pop\trbx,pop\trsi,pop\trdi,ret\t,nop\t,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x215a00\" greater than 0x100000\n Raw size of \".rdata\" is \"0x1cc400\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x2158e0\" greater than 0x100000\n Virtual size of \".rdata\" is \"0x1cc288\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\" has high imagebase \"0x180000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"rundll32.exe\" (UID: 00000000-00000196) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"rundll32.exe\" (UID: 00000000-00000196) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"General","name":"References Windows LDAP client module","description":"Found string \"Wldap32.dll\" (Source: \"00000000-00000196.00000000.170481.00280000.00000004.mdmp, 00000000-00000196.00000000.170481.00380000.00000004.mdmp, 00000000-00000196.00000001.172092.00280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-987","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"rundll32.exe\" with commandline \"\"C:\\\\3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f ...\" (UID: 00000000-00003672)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"rundll32.exe\" with commandline \"\"C:\\\\3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f ...\" (UID: 00000000-00003672)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"General","name":"The input sample contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 422025)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=Microsoft Azure RSA TLS Issuing CA 08, O=Microsoft Corporation, C=US\" (SHA1: CA:BF:68:28:CA:80:59:51:2F:5F:5C:12:97:C6:2C:2C:6F:FC:7B:4F; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Microsoft Azure RSA TLS Issuing CA 08, O=Microsoft Corporation, C=US\" (SHA1: D5:61:B2:A0:C2:9E:8F:F0:12:E2:72:F5:20:45:1A:76:F4:FA:3F:58; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"file/memory contains long string with (Indicator: \"CreateService\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n Found reference to API \"RtlCreateSecurityDescripRtlCreateServiceS\" (Indicator: \"CreateService\"; Source: \"00000000-00000196.00000000.170481.00280000.00000004.mdmp\")\n Found reference to API \"RtlCreateServiceSi\" (Indicator: \"CreateService\"; Source: \"00000000-00000196.00000000.170481.00280000.00000004.mdmp\")\n Found reference to API \"RtlCreateServiceSid\" (Indicator: \"CreateService\"; Source: \"00000000-00000196.00000000.170481.00280000.00000004.mdmp\")\n Found reference to API \"RtlCreateServiceRtlCRtlCr\" (Indicator: \"CreateService\"; Source: \"00000000-00000196.00000000.170481.00280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-199","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n file/memory contains long string with (Indicator: \"LoadLibrary\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000196.00000000.170481.FD428000.00000002.mdmp, 00000000-00000196.00000001.172092.57767000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to perform Process Doppelganging (API string)","description":"Found reference to API \"ZwRollbackTransaction\" (Indicator: \"RollbackTransaction\"; Source: \"00000000-00000196.00000000.170481.00280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.013","relevance":1,"id":"string-420","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)","description":"Found reference to API \"ZwQueueApcThreadZwQuZwQue\" (Indicator: \"QueueApcThread\"; Source: \"00000000-00000196.00000000.170481.00280000.00000004.mdmp\")\n Found reference to API \"ZwQueueApcThreadZwRaZwRai\" (Indicator: \"QueueApcThread\"; Source: \"00000000-00000196.00000000.170481.00280000.00000004.mdmp\")\n Found reference to API \"ZwQueryWnfStateNameInforZwQueueApcThreadE\" (Indicator: \"QueueApcThread\"; Source: \"00000000-00000196.00000000.170481.00280000.00000004.mdmp\")\n Found reference to API \"ZwQueueApcThreadEx\" (Indicator: \"QueueApcThread\"; Source: \"00000000-00000196.00000000.170481.00280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.004","relevance":1,"id":"string-255","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"rundll32.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$42","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"rundll32.exe\" queries basic process information of the \"C:\\Windows\\System32\\rundll32.exe\" (UID: 196)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$43","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$44","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to detect presence of virtual environment (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Able to detect virtual machine (string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: The input sample contains the RDTSCP instruction","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"rundll32.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\System32\\fltLib.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\System32\\rundll32.exe\"\n \"rundll32.exe\" trying to touch file \"C:\\windows\\temp\\VxOle64.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\WINDOWS\\system32\\IMM32.DLL\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\System32\\en-US\\rundll32.exe.mui\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"rundll32.exe\" trying to access non-existent file \"C:\\IPHLPAPI.DLL\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\VERSION.DLL\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\VERSION.dll\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\WINMM.DLL\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\WINMM.dll\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\WINMMBASE.DLL\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\WINMMBASE.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"rundll32.exe\" trying to access non-existent file \"C:\\3884CA8FF0E82370FC831F4B38C4E7004F474AE1A0087FF58B160D5082F031C2.BIN.DLL.MANIFEST\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin.dll.manifest\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\3884CA8FF0E82370FC831F4B38C4E7004F474AE1A0087FF58B160D5082F031C2.BIN.DLL.123.MANIFEST\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\3884CA8FF0E82370FC831F4B38C4E7004F474AE1A0087FF58B160D5082F031C2.BIN.DLL.124.MANIFEST\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"file/memory contains long string with (Indicator: \"getcomputernameexw\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n Found reference to API \"GetComputerNameExA\" (Indicator: \"getcomputernameexa\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"SetsockoptInt\" (Indicator: \"setsockopt\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n Found reference to API \"SetsockoptIPMreq\" (Indicator: \"setsockopt\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n Found reference to API \"SetsockoptLinger\" (Indicator: \"setsockopt\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n Found reference to API \"SetsockoptIPv6Mreq\" (Indicator: \"setsockopt\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n Found reference to API \"SetsockoptInet4Addr\" (Indicator: \"setsockopt\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n file/memory contains long string with (Indicator: \"setsockopt\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"file/memory contains long string with (Indicator: \"WSARecv\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n file/memory contains long string with (Indicator: \"WSASend\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n file/memory contains long string with (Indicator: \"WSAStartup\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"file/memory contains long string with (Indicator: \"WSARecv\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n file/memory contains long string with (Indicator: \"WSASend\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n file/memory contains long string with (Indicator: \"WSAStartup\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00000196-00000C2C-1631553322\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"$45","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"file/memory contains long string with (Indicator: \"setsockopt\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve information about user accounts on a server (API string)","description":"file/memory contains long string with (Indicator: \"NetUserEnum\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n file/memory contains long string with (Indicator: \"NetUserGetInfo\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n file/memory contains long string with (Indicator: \"NetUserGetLocalGroups\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")","origin":"File/Memory","mitre_attack_id":"T1087.001","relevance":1,"id":"string-112","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"file/memory contains long string with (Indicator: \"wsastartup\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n file/memory contains long string with (Indicator: \"wsacleanup\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n file/memory contains long string with (Indicator: \"gethostbyname\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n file/memory contains long string with (Indicator: \" send \"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; Source: \"00000000-00000196-00000C2C-1631553322\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"midimap.dll\" [Source: 00000000-00000196.00000000.170481.00400000.00000004.mdmp\n 00000000-00000196.00000001.172092.00280000.00000004.mdmp\n 00000000-00000196.00000001.172092.00400000.00000004.mdmp]\n Observed email domain:\"c:\\windows\\syswow64\\dpmodemx.dll\" [Source: 00000000-00000196.00000001.172092.00280000.00000004.mdmp]\n Observed email domain:\"dpmodemx.dll\" [Source: 00000000-00000196.00000001.172092.00280000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"3.0.0.0\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$46","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"Found URL \"https://go.dev/issue/66821):\" - Source: \"00000000-00003672.00000000.170484.00080000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Remote Access Related","name":"Able to modify Remote Configuration","description":"Found string \"System.Runtime.Remoting.dll\" (Source: \"00000000-00000196.00000001.172092.00280000.00000004.mdmp, 00000000-00000196.00000001.172092.00400000.00000004.mdmp\")\n Found string \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\System.Runtime.Remoting.dll\" (Source: \"00000000-00000196.00000001.172092.00400000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1021","relevance":1,"id":"string-940","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to perform remote desktop activity (API string)","description":"file/memory contains long string with (Indicator: \"WTSFreeMemory\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")","origin":"File/Memory","mitre_attack_id":"T1021.001","relevance":1,"id":"string-436","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote session information (API string)","description":"file/memory contains long string with (Indicator: \"WTSQueryUserToken\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n file/memory contains long string with (Indicator: \"WTSEnumerateSessions\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-546","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"kerberos.dll\" (Indicator: \"kerberos\"; Source: \"00000000-00000196.00000000.170481.00400000.00000004.mdmp, 00000000-00000196.00000001.172092.00280000.00000004.mdmp, 00000000-00000196.00000001.172092.00400000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access mailslot-related API (String)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-921","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"file/memory contains long string with (Indicator: \"GetDesktopWindow\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n Found reference to API \"GetWindowComposiGetWindoGetWindoGetWindowComposiGetWindowContextGetWindoGetWindoGetWindowDC\" (Indicator: \"GetWindowDC\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")\n Found reference to API \"GetWindowDC\" (Indicator: \"GetWindowDC\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"file/memory contains long string with (Indicator: \"getlogicaldrivestringsw\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n Found string \"GetLogicalDriveStringsA\" (Indicator: \"getlogicaldrivestringsa\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")\n Found string \"GetLogicalDriveStringsW\" (Indicator: \"getlogicaldrivestringsw\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"file/memory contains long string with (Indicator: \"RtlGetVersion\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n file/memory contains long string with (Indicator: \"RtlGetNtVersionNumbers\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n Found reference to API \"RtlGetNtProductType\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00000196.00000000.170481.00280000.00000004.mdmp\")\n Found reference to API \"RtlGetNtVersionNumbers\" (Indicator: \"RtlGetNtVersionNumbers\"; Source: \"00000000-00000196.00000000.170481.00280000.00000004.mdmp\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00000196.00000000.170481.00280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"Found string \"System.Data.OracleClient.dll\" (Indicator: \"System.Data.OracleClient\"; Source: \"00000000-00000196.00000001.172092.00280000.00000004.mdmp, 00000000-00000196.00000001.172092.00400000.00000004.mdmp\")\n Found string \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\System.Data.OracleClient.dll\" (Indicator: \"System.Data.OracleClient\"; Source: \"00000000-00000196.00000001.172092.00400000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$48","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"rundll32.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability retrieve IPv4 mapping information (API string)","description":"file/memory contains long string with (Indicator: \"GetIpForwardTable\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-87","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"GetMouseGetNextDGetMouseMovePoinGetNextDlgGroupIGetNextDGetOpenCGetNextDlgTabIteGetOpenClipboardGetParenGetPhysiGetParent\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to create/read/set mailslotinfo (API string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-110","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"file/memory contains long string with (Indicator: \"GetDriveType\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n file/memory contains long string with (Indicator: \"GetDriveType\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate logon sessions (API string)","description":"file/memory contains long string with (Indicator: \"WTSEnumerateSessions\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-117","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate running processes using Tasklist","description":"Observed string: \"tasklist.exe\" [Source: 00000000-00000196.00000000.170481.00280000.00000004.mdmp\n 00000000-00000196.00000001.172092.00280000.00000004.mdmp]\n Observed string: \"C:\\Windows\\SysWOW64\\tasklist.exe\" [Source: 00000000-00000196.00000001.172092.00280000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-517","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate trusted domains","description":"Found string \"nltest.exe\" (Indicator: \"nltest.exe\"; Source: \"00000000-00000196.00000000.170481.00400000.00000004.mdmp, 00000000-00000196.00000001.172092.00400000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1482","relevance":1,"id":"string-261","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"file/memory contains long string with (Indicator: \"GetLogicalDrives\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n file/memory contains long string with (Indicator: \"GetLogicalDriveStrings\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n Found reference to API \"GetLogicalDriveStringsA\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")\n Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"Found reference to API \"GetAdaptersAddresses\" (Indicator: \"GetAdaptersAddresses\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n file/memory contains long string with (Indicator: \"GetAdaptersInfo\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n file/memory contains long string with (Indicator: \"GetAdaptersAddresses\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ZwReadFile\" (Indicator: \"ZwReadFile\"; Source: \"00000000-00000196.00000000.170481.00280000.00000004.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00000196.00000000.170481.00280000.00000004.mdmp, 00000000-00000196.00000000.170481.FD428000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to register/read input devices (API string)","description":"Found reference to API \"GetRawInGetRawInGetRawInputBuffeGetRawInputData\" (Indicator: \"GetRawInputData\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")\n Found reference to API \"GetRawInputData\" (Indicator: \"GetRawInputData\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056","relevance":1,"id":"string-403","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"file/memory contains long string with (Indicator: \"LookupAccountName\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")","origin":"File/Memory","mitre_attack_id":"T1087","relevance":1,"id":"string-452","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n file/memory contains long string with (Indicator: \"GetProcAddress\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n file/memory contains long string with (Indicator: \"GetProcAddress\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp, 00000000-00000196.00000000.170481.FD428000.00000002.mdmp, 00000000-00000196.00000001.172092.57767000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about MS-DOS device names (API string)","description":"file/memory contains long string with (Indicator: \"QueryDosDevice\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-227","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"file/memory contains long string with (Indicator: \"GetProcessId\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n Found reference to API \"GetProcessIdOfThread\" (Indicator: \"GetProcessId\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")\n Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")\n Found reference to API \"GetProceGetProceGetProcessIdOfThGetProcessInformGetProceGetProceGetProcessIoCounGetProcessMitigaGetProceGetProceGetProcessPreferGetProcessPrioriGetProceGetProceGetProcessShutdoGetProcessTimes\" (Indicator: \"GetProcessId\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"file/memory contains long string with (Indicator: \"GetComputerName\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n Found reference to API \"GetComputerNameExA\" (Indicator: \"GetComputerName\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")\n Found reference to API \"BasepGetComputerNameFromNtPath\" (Indicator: \"GetComputerName\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"GetComputerName\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"file/memory contains long string with (Indicator: \"GetModuleFileName\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"file/memory contains long string with (Indicator: \"GetEnvironmentVariable\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"file/memory contains long string with (Indicator: \"getsockname\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSysteGetSysteGetSystemMetricsGetSystemMetricsGetSystemMetricsGetTabbeGetTabbeGetTabbedTextExtGetTabbedTextExtGetTaskmGetThreaGetTaskmanWindowGetTaskmanWindowGetThreadDesktopGetThreadDesktopGetThreaGetTitleGetThreadDpiAwarGetTitleBarInfo\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"file/memory contains long string with (Indicator: \"GetTickCount\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00000196.00000000.170481.FD428000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"file/memory contains long string with (Indicator: \"CheckTokenMembership\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n Found reference to API \"ZwQueryInformationToken\" (Indicator: \"ZwQueryInformationToken\"; Source: \"00000000-00000196.00000000.170481.00280000.00000004.mdmp\")\n Found reference to API \"CheckTokenMembershipEx\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \":\\windows\\system32\\passwordonwakesettingflyout.exe\" (Indicator: \"password\"; Source: \"00000000-00000196.00000001.172092.4E820000.00000004.mdmp\")\n Found string \"??\\c:\\windows\\system32\\passwordonwakesettingflyout.exe\" (Indicator: \"password\"; Source: \"00000000-00000196.00000001.172092.4E820000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"file/memory contains long string with (Indicator: \"route\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Strings related to file managers detected","description":"\"C:\\Windows\\System32\\NetDriverInstall.dll\" (Indicator: \"\\netdrive\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":3,"id":"string-136","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"System Destruction","name":"Contains ability to delete a user account from a server (API string)","description":"file/memory contains long string with (Indicator: \"NetUserDel\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")","origin":"File/Memory","mitre_attack_id":"T1531","relevance":1,"id":"string-216","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"System Security","name":"Able to change the configuration parameters of a service","description":"file/memory contains long string with (Indicator: \"changeserviceconfigw\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-10073","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RtlDeleteRegistryValue\" in \"00000000-00000196.00000000.170481.00280000.00000004.mdmp\"\n Found registry deletion API: \"ZwDeleteKey\" in \"00000000-00000196.00000000.170481.00280000.00000004.mdmp\"\n Found registry deletion API: \"ZwDeleteValueKeyZwDeZwDel\" in \"00000000-00000196.00000000.170481.00280000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00000196.00000000.170481.4E820000.00000004.mdmp, 00000000-00000196.00000001.172092.4E820000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\\Windows\\System32\\rundll32.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00000196.00000000.170481.4E820000.00000004.mdmp, 00000000-00000196.00000001.172092.4E820000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"System Security","name":"Contains ability to bypass UAC using COM object (API string)","description":"file/memory contains long string with (Indicator: \"CoGetObject\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")","origin":"File/Memory","mitre_attack_id":"T1548.002","relevance":1,"id":"string-239","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"file/memory contains long string with (Indicator: \"WTSQueryUserToken\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n file/memory contains long string with (Indicator: \"CreateProcessAsUser\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n file/memory contains long string with (Indicator: \"ImpersonateLoggedOnUser\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete device information set (API string)","description":"file/memory contains long string with (Indicator: \"SetupDiDestroyDeviceInfoList\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")","origin":"File/Memory","mitre_attack_id":"T1485","relevance":1,"id":"string-442","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"$50","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"file/memory contains long string with (Indicator: \"CheckTokenMembership\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n file/memory contains long string with (Indicator: \"AdjustTokenPrivileges\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n file/memory contains long string with (Indicator: \"LookupPrivilegeValue\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n Found reference to API \"ZwQueryInformationToken\" (Indicator: \"ZwQueryInformationToken\"; Source: \"00000000-00000196.00000000.170481.00280000.00000004.mdmp\")\n Found reference to API \"CheckTokenMembershipEx\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"file/memory contains long string with (Indicator: \"SetFileAttributes\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n file/memory contains long string with (Indicator: \"SetInformationFile\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n file/memory contains long string with (Indicator: \"NtSetInformationFile\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n Found reference to API \"ZwSetInformationFile\" (Indicator: \"SetInformationFile\"; Source: \"00000000-00000196.00000000.170481.00280000.00000004.mdmp\")\n Found reference to API \"ZwSetInformationFile\" (Indicator: \"ZwSetInformationFile\"; Source: \"00000000-00000196.00000000.170481.00280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"file/memory contains long string with (Indicator: \"UpdateProcThreadAttribute\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n file/memory contains long string with (Indicator: \"InitializeProcThreadAttributeList\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$51","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"System Security","name":"Contains ability to set/delete MS-DOS device name (API string)","description":"file/memory contains long string with (Indicator: \"DefineDosDevice\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n Found reference to API \"DecodeSyDefineDoDecodeSystemPoinDefineDosDeviceADefineDosDeviceADefineDoDelayLoaDefineDosDeviceWDefineDosDeviceWDelayLoadFailureDeleteAtDeleteBoDeleteAtom\" (Indicator: \"DefineDosDevice\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-466","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: 3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\n Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00000196.00000001.172092.57767000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$52","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n Found reference to API \"ZwWriteFile\" (Indicator: \"ZwWriteFile\"; Source: \"00000000-00000196.00000000.170481.00280000.00000004.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00000196.00000000.170481.00280000.00000004.mdmp, 00000000-00000196.00000001.172092.57767000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$53","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"file/memory contains long string with (Indicator: \"NetApiBufferFree\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"file/memory contains long string with (Indicator: \"ExitWindows\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n file/memory contains long string with (Indicator: \"InitiateSystemShutdown\"; File: \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\")\n Found reference to API \"ZwInitiatePowerAction\" (Indicator: \"InitiatePowerAction\"; Source: \"00000000-00000196.00000000.170481.00280000.00000004.mdmp\")\n Found reference to API \"ZwRaiseHardErrorZwReZwRea\" (Indicator: \"RaiseHardError\"; Source: \"00000000-00000196.00000000.170481.00280000.00000004.mdmp\")\n Found reference to API \"ZwShutdownSystemZwShZwShu\" (Indicator: \"ShutdownSystem\"; Source: \"00000000-00000196.00000000.170481.00280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"svchost.exe,wininit.exe,winlogon.exe,update.exe,csrss.exe\" (Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp, 00000000-00000196.00000001.172092.00280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"$54","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"$55","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"Found string \"dbghelp.dll\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00000196.00000000.170481.00380000.00000004.mdmp, 00000000-00000196.00000001.172092.00280000.00000004.mdmp\")\n Found string \"pstorec.dll\" (Indicator: \"pstorec.dll\"; Source: \"00000000-00000196.00000000.170481.00400000.00000004.mdmp, 00000000-00000196.00000001.172092.00400000.00000004.mdmp\")\n Found string \"C:\\Windows\\SysWOW64\\dbghelp.dll\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00000196.00000001.172092.00280000.00000004.mdmp\")\n Found string \"pstorec.dllpt-BRpt-PT\" (Indicator: \"pstorec.dll\"; Source: \"00000000-00000196.00000001.172092.00280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\Windows\\System32\\rundll32.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":3,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"3/26 Antivirus vendors marked sample as malicious (11% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"\"rundll32.exe\" monitors \"HKLM\\SYSTEM\\ControlSet001\\Services\\WinSock2\\Parameters\\Protocol_Catalog9\" (Filter: 1; Subtree: 0)\n \"rundll32.exe\" monitors \"HKLM\\SYSTEM\\ControlSet001\\Services\\WinSock2\\Parameters\\NameSpace_Catalog5\" (Filter: 1; Subtree: 0)","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"suspicious","category":"Network Related","name":"Able to retrieve local network connections","description":"Found string \"nbtstat.exe\" (Indicator: \"nbtstat\"; Source: \"00000000-00000196.00000000.170481.00400000.00000004.mdmp, 00000000-00000196.00000001.172092.00400000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-361","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - ChaCha20 encryption algorithm","description":"YARA signature for ChaCha20 256-bit key algorithm matched on file \"sample.bin\"\n YARA signature for ChaCha20 128-bit key algorithm matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":9,"id":"yara-44","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Found TLS callbacks","description":"\"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\" has a TLS callback with entrypoint at 0x1802158d0\n \"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin\" has a TLS callback with entrypoint at 0x1802158b0","origin":"Static Parser","mitre_attack_id":"T1055.005","relevance":10,"id":"static-17","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetThreadContext\n GetSystemInfo\n Sleep\n LoadLibraryW\n VirtualAlloc\n CreateThread\n VirtualProtect\n LoadLibraryExW\n WriteFile\n GetSystemDirectoryA\n GetProcAddress","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Sample translates to unusual binary language","description":"Traditional Chinese (ID: 0x0404)","origin":"Static Parser","relevance":10,"id":"static-8","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]},{"level":"malicious","category":"General","name":"The input sample is signed with an invalid certificate","description":"Error: A certificate chain processed\n but terminated in a root certificate which is not trusted by the trust provider. (0x800b0109)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-1","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]}]},"activity":{"stats":{"process_count":7,"spawned_processes_count":7,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":36,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["windows-server-utility"],"sample_flags":["Multi-Process","Sample Crashed"],"sandbox_reports":[{"id":"69e5ca05b567632bd40db83f","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":57,"malware_family":"W64.Loader.k","submit_name":"3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin","analysis_start_time":"2026-04-20T06:39:03+00:00","indicators_count":{"informative":211,"suspicious":9,"malicious":1},"tags":["Multi-Process","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}],"processes":[{"pid":6004,"ppid":0,"name":"","command_line":"","normalized_path":"","uid":"00000000-00006004"},{"pid":196,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin.dll\",#1","sha256":"b1e6a7a3e2597e51836277a32b2bc61aa781c8f681d44dfddea618b32e2bf2a6","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00000196","icon":"$56"},{"pid":3672,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin.dll\",#2","sha256":"b1e6a7a3e2597e51836277a32b2bc61aa781c8f681d44dfddea618b32e2bf2a6","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00003672","icon":"$57"},{"pid":2076,"ppid":3672,"name":"WerFault.exe","command_line":"-u -p 3672 -s 372","sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00003672","uid":"00000000-00002076"},{"pid":4844,"ppid":3672,"name":"WerFault.exe","command_line":"-u -p 3672 -s 372","sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00003672","uid":"00000000-00004844"},{"pid":1052,"ppid":3672,"name":"WerFault.exe","command_line":"-u -p 3672 -s 372","sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00003672","uid":"00000000-00001052"},{"pid":7244,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 440 -p 3672 -ip 3672","sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00007244","icon":"$58"}],"all_imported_dlls":["imm32.dll","IPHLPAPI.DLL","cfgmgr32.dll","ws2_32.dll","msvcp_win.dll","shlwapi.dll","uxtheme.dll","combase.dll","ucrtbase.dll","rpcrt4.dll","bcryptprimitives.dll","ole32.dll","oleaut32.dll","psapi.dll","winmm.dll","msctf.dll","fltLib.dll","imagehlp.dll","win32u.dll","advapi32.dll","sechost.dll","user32.dll","gdi32full.dll","version.dll","powrprof.dll","ntdll.dll","kernel32.dll","KernelBase.dll","msvcrt.dll","SHCore.dll","gdi32.dll","winmmbase.dll","dwmapi.dll","VxSSL64.dll","cryptsp.dll","3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2.bin.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"69e5ca05b567632bd40db83f"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["69e5ca05b567632bd40db83f"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan_Win32_Wacatac_B_ml Sample 3884ca8ff0e8… — Score 57/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 3884ca8ff0e8…. Malware family: Trojan_Win32_Wacatac_B_ml. Threat score 57/100. 3/27 AV engines flagged this file. 1 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan_Win32_Wacatac_B_ml Sample 3884ca8ff0e8… — Score 57/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 3884ca8ff0e8…. Malware family: Trojan_Win32_Wacatac_B_ml. Threat score 57/100. 3/27 AV engines flagged this file. 1 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/3884ca8ff0e82370fc831f4b38c4e7004f474ae1a0087ff58b160d5082f031c2"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan_Win32_Wacatac_B_ml Sample 3884ca8ff0e8… — Score 57/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 3884ca8ff0e8…. Malware family: Trojan_Win32_Wacatac_B_ml. Threat score 57/100. 3/27 AV engines flagged this file. 1 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L59","11",{}]]