25:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 26:Td76,Found string "IoCreateDevice should only be called at IRQL <= APC_LEVEL." (Indicator: "APC_LEVEL"; Source: "sample.bin"), Found string "ExInitializePagedLookasideList should only be called at IRQL <= APC_LEVEL." (Indicator: "APC_LEVEL"; Source: "sample.bin"), Found string "ExAllocatePoolWithTag can be called at DISPATCH_LEVEL only if a NonPagedXXX is specified for PoolType, not PagedPool." (Indicator: "DISPATCH_LEVEL"; Source: "sample.bin"), Found string "KePulseEvent should only be called at IRQL <= DISPATCH_LEVEL." (Indicator: "DISPATCH_LEVEL"; Source: "sample.bin"), Found string "ZwCreateKey should only be called at IRQL = PASSIVE_LEVEL." (Indicator: "PASSIVE_LEVEL"; Source: "sample.bin"), Found string "ZwQueryKey should only be called at IRQL = PASSIVE_LEVEL." (Indicator: "PASSIVE_LEVEL"; Source: "sample.bin"), Found string "ExAllocatePool can be called at DISPATCH_LEVEL only if a NonPagedXXX is specified for PoolType, not MaxPoolType." (Indicator: "DISPATCH_LEVEL"; Source: "sample.bin"), Found string "KeSetTimer should only be called at IRQL <= DISPATCH_LEVEL." (Indicator: "DISPATCH_LEVEL"; Source: "sample.bin"), Found string "PsSetLoadImageNotifyRoutine should only be called at IRQL = PASSIVE_LEVEL." (Indicator: "PASSIVE_LEVEL"; Source: "sample.bin"), Found string "SDV_FreeAdapterChannel should only be called at IRQL == DISPATCH_LEVEL." (Indicator: "DISPATCH_LEVEL"; Source: "sample.bin"), Found string "SDV_BuildMdlFromScatterGatherList should only be called at IRQL <= DISPATCH_LEVEL." (Indicator: "DISPATCH_LEVEL"; Source: "sample.bin"), Found string "MmAllocatePagesForMdl should only be called at IRQL <= DISPATCH_LEVEL." (Indicator: "DISPATCH_LEVEL"; Source: "sample.bin"), Found string "IoDeleteController should only be called at IRQL = PASSIVE_LEVEL." (Indicator: "PASSIVE_LEVEL"; Source: "sample.bin"), Found string "IoGetConfigurationInformation should only be called at IRQL = PASSIVE_LEVEL." (Indicator: "PASSIVE_LEVEL"; Source: "sample.bin"), Found string "IoUpdateShareAccess should only be called at IRQL = PASSIVE_LEVEL." (Indicator: "PASSIVE_LEVEL"; Source: "sample.bin"), Found string "KeReleaseGuardedMutex should only be called at IRQL <= APC_LEVEL." (Indicator: "APC_LEVEL"; Source: "sample.bin"), Found string "ExRegisterCallback should only be called at IRQL <= APC_LEVEL." (Indicator: "APC_LEVEL"; Source: "sample.bin"), Found string "KeInsertByKeyDeviceQueue should only be called at IRQL == DISPATCH_LEVEL." (Indicator: "DISPATCH_LEVEL"; Source: "sample.bin"), Found string "ExSetTimerResolution should only be called at IRQL <= APC_LEVEL." (Indicator: "APC_LEVEL"; Source: "sample.bin"), Found string "IoWMIAllocateInstanceIds should only be called at IRQL = PASSIVE_LEVEL." (Indicator: "PASSIVE_LEVEL"; Source: "sample.bin"), Found string "ZwDeleteValueKey should only be called at IRQL = PASSIVE_LEVEL." (Indicator: "PASSIVE_LEVEL"; Source: "sample.bin"), Found string "IoCreateUnprotectedSymbolicLink should only be called at IRQL = PASSIVE_LEVEL." (Indicator: "PASSIVE_LEVEL"; Source: "sample.bin"), Found string "ZwSetEaFile should only be called at IRQL = PASSIVE_LEVEL." (Indicator: "PASSIVE_LEVEL"; Source: "sample.bin"), Found string "MmLockPagableSectionByHandle should only be called at IRQL <= APC_LEVEL." (Indicator: "APC_LEVEL"; Source: "sample.bin"), Found string "ZwRenameKey should only be called at IRQL = PASSIVE_LEVEL." (Indicator: "PASSIVE_LEVEL"; Source: "sample.bin")27:T4b6f,Found reference to API (Indicator: "KeRegisterNmiCallback"; Source: "sample.bin"), Found reference to API (Indicator: "PoFxIdleComponent"; Source: "sample.bin"), Found reference to API (Indicator: "NtWriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "ZwQueryValueKey"; Source: "sample.bin"), Found reference to API (Indicator: "PoFxCompleteIdleState"; Source: "sample.bin"), Found reference to API (Indicator: "ZwEnumerateKey"; Source: "sample.bin"), Found reference to API (Indicator: "MmProbeAndLockPages"; Source: "sample.bin"), Found reference to API (Indicator: "KeReleaseInStackQueuedSpinLockForDpc"; Source: "sample.bin"), Found reference to API (Indicator: "KeAcquireGuardedMutexUnsafe"; Source: "sample.bin"), Found reference to API (Indicator: "KeReleaseSpinLock"; Source: "sample.bin"), Found reference to API (Indicator: "ExpInterlockedPopEntrySList"; Source: "sample.bin"), Found reference to API (Indicator: "IoCreateSynchronizationEvent"; Source: "sample.bin"), Found reference to API (Indicator: "ZwCreateFile"; Source: "sample.bin"), Found reference to API (Indicator: "ExReleaseSpinLockSharedFromDpcLevel"; Source: "sample.bin"), Found reference to API (Indicator: "ZwQueryKey"; Source: "sample.bin"), Found reference to API (Indicator: "ZwOpenKeyTransacted"; Source: "sample.bin"), Found reference to API (Indicator: "ZwCreateKey"; Source: "sample.bin"), Found reference to API (Indicator: "ZwDeleteKey"; Source: "sample.bin"), Found reference to API (Indicator: "RtlGetOwnerSecurityDescriptor"; Source: "sample.bin"), Found reference to API (Indicator: "PoFxSetComponentResidency"; Source: "sample.bin"), Found reference to API (Indicator: "PoFxCompleteDevicePowerNotRequired"; Source: "sample.bin"), Found reference to API (Indicator: "ZwSetValueKey"; Source: "sample.bin"), Found reference to API (Indicator: "IoDisconnectInterrupt"; Source: "sample.bin"), Found reference to API (Indicator: "KeClearEvent"; Source: "sample.bin"), Found reference to API (Indicator: "KeSetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "ExpInterlockedPushEntrySList"; Source: "sample.bin"), Found reference to API (Indicator: "ExAcquireSharedWaitForExclusive"; Source: "sample.bin"), Found reference to API (Indicator: "RtlDeleteRegistryValue"; Source: "sample.bin"), Found reference to API (Indicator: "ZwSetInformationFile"; Source: "sample.bin"), Found reference to API (Indicator: "KeRemoveEntryDeviceQueue"; Source: "sample.bin"), Found reference to API (Indicator: "MmLockPagableDataSection"; Source: "sample.bin"), Found reference to API (Indicator: "MmUnlockPages"; Source: "sample.bin"), Found reference to API (Indicator: "IoCreateUnprotectedSymbolicLink"; Source: "sample.bin"), Found reference to API (Indicator: "ExFreePoolWithTag"; Source: "sample.bin"), Found reference to API (Indicator: "MmAllocatePagesForMdlEx"; Source: "sample.bin"), Found reference to API (Indicator: "ExInitializeNPagedLookasideList"; Source: "sample.bin"), Found reference to API (Indicator: "PsTerminateSystemThread"; Source: "sample.bin"), Found reference to API (Indicator: "PoFxUnregisterDevice"; Source: "sample.bin"), Found reference to API (Indicator: "RtlGetSaclSecurityDescriptor"; Source: "sample.bin"), Found reference to API (Indicator: "ExRaiseStatus"; Source: "sample.bin"), Found reference to API (Indicator: "KeQueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "IoFreeMdl"; Source: "sample.bin"), Found reference to API (Indicator: "CmUnRegisterCallback"; Source: "sample.bin"), Found reference to API (Indicator: "ExAllocatePool"; Source: "sample.bin"), Found reference to API (Indicator: "MmFreePagesFromMdl"; Source: "sample.bin"), Found reference to API (Indicator: "KeResetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "IoIsWdmVersionAvailable"; Source: "sample.bin"), Found reference to API (Indicator: "IoDetachDevice"; Source: "sample.bin"), Found reference to API (Indicator: "NtCreateFile"; Source: "sample.bin"), Found reference to API (Indicator: "IoDeleteSymbolicLink"; Source: "sample.bin"), Found reference to API (Indicator: "KeAcquireInStackQueuedSpinLockAtDpcLevel"; Source: "sample.bin"), Found reference to API (Indicator: "ZwCreateDirectoryObject"; Source: "sample.bin"), Found reference to API (Indicator: "ZwClose"; Source: "sample.bin"), Found reference to API (Indicator: "KeSetTimer"; Source: "sample.bin"), Found reference to API (Indicator: "ExAcquireSpinLockShared"; Source: "sample.bin"), Found reference to API (Indicator: "RtlFreeAnsiString"; Source: "sample.bin"), Found reference to API (Indicator: "RtlGetGroupSecurityDescriptor"; Source: "sample.bin"), Found reference to API (Indicator: "ExReleaseResourceAndLeaveCriticalRegion"; Source: "sample.bin"), Found reference to API (Indicator: "ZwDeleteFile"; Source: "sample.bin"), Found reference to API (Indicator: "IoInitializeTimer"; Source: "sample.bin"), Found reference to API (Indicator: "KeLowerIrql"; Source: "sample.bin"), Found reference to API (Indicator: "KeDeregisterNmiCallback"; Source: "sample.bin"), Found reference to API (Indicator: "IoAttachDevice"; Source: "sample.bin"), Found reference to API (Indicator: "ExAcquireResourceExclusiveLite"; Source: "sample.bin"), Found reference to API (Indicator: "IofCompleteRequest"; Source: "sample.bin"), Found reference to API (Indicator: "ExAcquireResourceSharedLite"; Source: "sample.bin"), Found reference to API (Indicator: "PsGetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "PoFxStartDevicePowerManagement"; Source: "sample.bin"), Found reference to API (Indicator: "KeInitializeSemaphore"; Source: "sample.bin"), Found reference to API (Indicator: "ExAcquireSharedStarveExclusive"; Source: "sample.bin"), Found reference to API (Indicator: "RtlCreateSecurityDescriptor"; Source: "sample.bin"), Found reference to API (Indicator: "PoFxReportDevicePoweredOn"; Source: "sample.bin"), Found reference to API (Indicator: "MmAllocateContiguousMemorySpecifyCache"; Source: "sample.bin"), Found reference to API (Indicator: "PoFxActivateComponent"; Source: "sample.bin"), Found reference to API (Indicator: "KeReleaseGuardedMutex"; Source: "sample.bin"), Found reference to API (Indicator: "IoCheckShareAccess"; Source: "sample.bin"), Found reference to API (Indicator: "ExDeleteTimer"; Source: "sample.bin"), Found reference to API (Indicator: "KeReleaseMutex"; Source: "sample.bin"), Found reference to API (Indicator: "ExAllocateTimer"; Source: "sample.bin"), Found reference to API (Indicator: "ExAllocatePoolWithQuota"; Source: "sample.bin"), Found reference to API (Indicator: "MmResetDriverPaging"; Source: "sample.bin"), Found reference to API (Indicator: "RtlAddAccessAllowedAce"; Source: "sample.bin"), Found reference to API (Indicator: "ExReleaseSpinLockShared"; Source: "sample.bin"), Found reference to API (Indicator: "ExIsProcessorFeaturePresent"; Source: "sample.bin"), Found reference to API (Indicator: "RtlWriteRegistryValue"; Source: "sample.bin"), Found reference to API (Indicator: "PoFxRegisterDevice"; Source: "sample.bin"), Found reference to API (Indicator: "ZwEnumerateValueKey"; Source: "sample.bin"), Found reference to API (Indicator: "PoRequestPowerIrp"; Source: "sample.bin"), Found reference to API (Indicator: "RtlAbsoluteToSelfRelativeSD"; Source: "sample.bin"), Found reference to API (Indicator: "RtlGetDaclSecurityDescriptor"; Source: "sample.bin"), Found reference to API (Indicator: "IoBuildDeviceIoControlRequest"; Source: "sample.bin"), Found reference to API (Indicator: "IoRemoveShareAccess"; Source: "sample.bin"), Found reference to API (Indicator: "KeReleaseGuardedMutexUnsafe"; Source: "sample.bin"), Found reference to API (Indicator: "IoRegisterShutdownNotification"; Source: "sample.bin"), Found reference to API (Indicator: "ProbeForRead"; Source: "sample.bin"), Found reference to API (Indicator: "ExRegisterCallback"; Source: "sample.bin"), Found reference to API (Indicator: "KeFlushQueuedDpcs"; Source: "sample.bin"), Found reference to API (Indicator: "MmGetSystemRoutineAddress"; Source: "sample.bin"), Found reference to API (Indicator: "ExReleaseSpinLockExclusive"; Source: "sample.bin"), Found reference to API (Indicator: "ExFreePool"; Source: "sample.bin"), Found reference to API (Indicator: "IoGetStackLimits"; Source: "sample.bin"), Found reference to API (Indicator: "RtlInitAnsiString"; Source: "sample.bin"), Found reference to API (Indicator: "KeInitializeSpinLock"; Source: "sample.bin"), Found reference to API (Indicator: "KeAcquireInStackQueuedSpinLock"; Source: "sample.bin"), Found reference to API (Indicator: "KeReleaseInStackQueuedSpinLock"; Source: "sample.bin"), Found reference to API (Indicator: "KeQueryActiveProcessors"; Source: "sample.bin"), Found reference to API (Indicator: "RtlCreateRegistryKey"; Source: "sample.bin"), Found reference to API (Indicator: "RtlInitUnicodeString"; Source: "sample.bin"), Found reference to API (Indicator: "ObReferenceObjectByHandle"; Source: "sample.bin"), Found reference to API (Indicator: "IoRegisterDeviceInterface"; Source: "sample.bin"), Found reference to API (Indicator: "ExTryToAcquireFastMutex"; Source: "sample.bin"), Found reference to API (Indicator: "KeBugCheckEx"; Source: "sample.bin"), Found reference to API (Indicator: "ExReleaseResourceLite"; Source: "sample.bin"), Found reference to API (Indicator: "MmMapLockedPagesSpecifyCache"; Source: "sample.bin"), Found reference to API (Indicator: "KeAcquireSpinLockRaiseToDpc"; Source: "sample.bin"), Found reference to API (Indicator: "NtSetInformationFile"; Source: "sample.bin"), Found reference to API (Indicator: "MmFreeContiguousMemory"; Source: "sample.bin"), Found reference to API (Indicator: "KeAcquireSpinLockAtDpcLevel"; Source: "sample.bin"), Found reference to API (Indicator: "KeReadStateTimer"; Source: "sample.bin"), Found reference to API (Indicator: "IoOpenDeviceInterfaceRegistryKey"; Source: "sample.bin"), Found reference to API (Indicator: "MmSecureVirtualMemory"; Source: "sample.bin"), Found reference to API (Indicator: "KeSetTimerEx"; Source: "sample.bin"), Found reference to API (Indicator: "KeSaveExtendedProcessorState"; Source: "sample.bin"), Found reference to API (Indicator: "ExAcquireFastMutex"; Source: "sample.bin"), Found reference to API (Indicator: "IoValidateDeviceIoControlAccess"; Source: "sample.bin"), Found reference to API (Indicator: "CmRegisterCallback"; Source: "sample.bin"), Found reference to API (Indicator: "KeReleaseInStackQueuedSpinLockFromDpcLevel"; Source: "sample.bin"), Found reference to API (Indicator: "MmPageEntireDriver"; Source: "sample.bin"), Found reference to API (Indicator: "IoOpenDriverRegistryKey"; Source: "sample.bin"), Found reference to API (Indicator: "KeInsertByKeyDeviceQueue"; Source: "sample.bin"), Found reference to API (Indicator: "KeIsExecutingDpc"; Source: "sample.bin"), Found reference to API (Indicator: "PoFxCompleteIdleCondition"; Source: "sample.bin"), Found reference to API (Indicator: "PsCreateSystemThread"; Source: "sample.bin"), Found reference to API (Indicator: "ExQueryDepthSList"; Source: "sample.bin"), Found reference to API (Indicator: "MmUnsecureVirtualMemory"; Source: "sample.bin"), Found reference to API (Indicator: "ExUnregisterCallback"; Source: "sample.bin"), Found reference to API (Indicator: "IoAllocateWorkItem"; Source: "sample.bin"), Found reference to API (Indicator: "IoWMIRegistrationControl"; Source: "sample.bin"), Found reference to API (Indicator: "KeInitializeDeviceQueue"; Source: "sample.bin"), Found reference to API (Indicator: "KeTryToAcquireGuardedMutex"; Source: "sample.bin"), Found reference to API (Indicator: "ObGetObjectSecurity"; Source: "sample.bin"), Found reference to API (Indicator: "IoQueueWorkItem"; Source: "sample.bin"), Found reference to API (Indicator: "ZwOpenKeyEx"; Source: "sample.bin"), Found reference to API (Indicator: "IoConnectInterrupt"; Source: "sample.bin"), Found reference to API (Indicator: "KeLeaveCriticalRegion"; Source: "sample.bin"), Found reference to API (Indicator: "IoFreeWorkItem"; Source: "sample.bin"), Found reference to API (Indicator: "IoSetShareAccess"; Source: "sample.bin"), Found reference to API (Indicator: "ObReleaseObjectSecurity"; Source: "sample.bin"), Found reference to API (Indicator: "KeGetCurrentIrql"; Source: "sample.bin"), Found reference to API (Indicator: "MmAllocateContiguousMemory"; Source: "sample.bin"), Found reference to API (Indicator: "IoWMIAllocateInstanceIds"; Source: "sample.bin"), Found reference to API (Indicator: "KeEnterGuardedRegion"; Source: "sample.bin"), Found reference to API (Indicator: "ZwCreateKeyTransacted"; Source: "sample.bin"), Found reference to API (Indicator: "ZwDeleteValueKey"; Source: "sample.bin"), Found reference to API (Indicator: "KeAcquireGuardedMutex"; Source: "sample.bin"), Found reference to API (Indicator: "IoCreateNotificationEvent"; Source: "sample.bin"), Found reference to API (Indicator: "KeAcquireInStackQueuedSpinLockForDpc"; Source: "sample.bin"), Found reference to API (Indicator: "KeRestoreExtendedProcessorState"; Source: "sample.bin"), Found reference to API (Indicator: "IoGetInitialStack"; Source: "sample.bin"), Found reference to API (Indicator: "PoFxSetComponentWake"; Source: "sample.bin"), Found reference to API (Indicator: "IoGetDmaAdapter"; Source: "sample.bin"), Found reference to API (Indicator: "RtlQueryRegistryValues"; Source: "sample.bin"), Found reference to API (Indicator: "IoWriteErrorLogEntry"; Source: "sample.bin"), Found reference to API (Indicator: "RtlEqualUnicodeString"; Source: "sample.bin"), Found reference to API (Indicator: "ProbeForWrite"; Source: "sample.bin"), Found reference to API (Indicator: "KeDelayExecutionThread"; Source: "sample.bin"), Found reference to API (Indicator: "IoUpdateShareAccess"; Source: "sample.bin"), Found reference to API (Indicator: "ExDeleteResourceLite"; Source: "sample.bin"), Found reference to API (Indicator: "RtlCheckRegistryKey"; Source: "sample.bin"), Found reference to API (Indicator: "ExAcquireSpinLockSharedAtDpcLevel"; Source: "sample.bin"), Found reference to API (Indicator: "PoFxPowerControl"; Source: "sample.bin"), Found reference to API (Indicator: "IoCreateFile"; Source: "sample.bin"), Found reference to API (Indicator: "CmRegisterCallbackEx"; Source: "sample.bin"), Found reference to API (Indicator: "IoOpenDeviceRegistryKey"; Source: "sample.bin"), Found reference to API (Indicator: "RtlAppendUnicodeStringToString"; Source: "sample.bin"), Found reference to API (Indicator: "KeEnterCriticalRegion"; Source: "sample.bin"), Found reference to API (Indicator: "IoGetDriverDirectory"; Source: "sample.bin"), Found reference to API (Indicator: "ZwFlushKey"; Source: "sample.bin"), Found reference to API (Indicator: "IoStartNextPacket"; Source: "sample.bin"), Found reference to API (Indicator: "RtlCreateSystemVolumeInformationFolder"; Source: "sample.bin"), Found reference to API (Indicator: "RtlAppendStringToString"; Source: "sample.bin"), Found reference to API (Indicator: "KeRemoveDeviceQueue"; Source: "sample.bin"), Found reference to API (Indicator: "ExAllocatePoolWithTag"; Source: "sample.bin"), Found reference to API (Indicator: "ZwOpenKey"; Source: "sample.bin"), Found reference to API (Indicator: "ExSetTimerResolution"; Source: "sample.bin"), Found reference to API (Indicator: "ZwOpenKeyTransactedEx"; Source: "sample.bin"), Found reference to API (Indicator: "IoGetDeviceDirectory"; Source: "sample.bin"), Found reference to API (Indicator: "MmMapIoSpace"; Source: "sample.bin"), Found reference to API (Indicator: "KeQueryDpcWatchdogInformation"; Source: "sample.bin"), Found reference to API (Indicator: "IoUnregisterShutdownNotification"; Source: "sample.bin"), Found reference to API (Indicator: "ExDeletePagedLookasideList"; Source: "sample.bin"), Found reference to API (Indicator: "ExAcquireSpinLockExclusive"; Source: "sample.bin"), Found reference to API (Indicator: "KeRemoveByKeyDeviceQueue"; Source: "sample.bin"), Found reference to API (Indicator: "PsGetVersion"; Source: "sample.bin"), Found reference to API (Indicator: "RtlCaptureStackBackTrace"; Source: "sample.bin"), Found reference to API (Indicator: "RtlCompareUnicodeString"; Source: "sample.bin"), Found reference to API (Indicator: "ZwWriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "ExCreateCallback"; Source: "sample.bin"), Found reference to API (Indicator: "KeLeaveGuardedRegion"; Source: "sample.bin"), Found reference to API (Indicator: "KeReadStateEvent"; Source: "sample.bin"), Found reference to API (Indicator: "IoDeleteDevice"; Source: "sample.bin"), Found reference to API (Indicator: "MmAllocatePagesForMdl"; Source: "sample.bin"), Found reference to API (Indicator: "ExInitializePagedLookasideList"; Source: "sample.bin"), Found reference to API (Indicator: "KeCancelTimer"; Source: "sample.bin"), Found reference to API (Indicator: "ExConvertExclusiveToSharedLite"; Source: "sample.bin"), Found reference to API (Indicator: "IoUninitializeWorkItem"; Source: "sample.bin"), Found reference to API (Indicator: "PoFxSetComponentLatency"; Source: "sample.bin"), Found reference to API (Indicator: "RtlCompareMemory"; Source: "sample.bin"), Found reference to API (Indicator: "ExAllocatePoolWithTagPriority"; Source: "sample.bin"), Found reference to API (Indicator: "MmUnlockPagableImageSection"; Source: "sample.bin"), Found reference to API (Indicator: "RtlFreeUnicodeString"; Source: "sample.bin"), Found reference to API (Indicator: "IoAllocateIrp"; Source: "sample.bin"), Found reference to API (Indicator: "IoGetDeviceObjectPointer"; Source: "sample.bin"), Found reference to API (Indicator: "ExAllocatePoolWithQuotaTag"; Source: "sample.bin"), Found reference to API (Indicator: "KeStallExecutionProcessor"; Source: "sample.bin"), Found reference to API (Indicator: "ExEnterCriticalRegionAndAcquireResourceExclusive"; Source: "sample.bin"), Found reference to API (Indicator: "ExSetTimer"; Source: "sample.bin"), Found reference to API (Indicator: "KeInitializeTimer"; Source: "sample.bin"), Found reference to API (Indicator: "KeInsertDeviceQueue"; Source: "sample.bin"), Found reference to API (Indicator: "RtlHashUnicodeString"; Source: "sample.bin"), Found reference to API (Indicator: "KeReleaseSpinLockFromDpcLevel"; Source: "sample.bin"), Found reference to API (Indicator: "PoFxNotifySurprisePowerOn"; Source: "sample.bin"), Found reference to API (Indicator: "ExAllocatePool2"; Source: "sample.bin"), Found reference to API (Indicator: "ExAllocatePool3"; Source: "sample.bin"), Found reference to API (Indicator: "IoAllocateMdl"; Source: "sample.bin"), Found reference to API (Indicator: "IoCreateDevice"; Source: "sample.bin"), Found reference to API (Indicator: "ExInitializeResourceLite"; Source: "sample.bin"), Found reference to API (Indicator: "KeTryToAcquireSpinLockAtDpcLevel"; Source: "sample.bin"), Found reference to API (Indicator: "IoSetDeviceInterfaceState"; Source: "sample.bin"), Found reference to API (Indicator: "PoFxSetDeviceIdleTimeout"; Source: "sample.bin"), Found reference to API (Indicator: "IoCreateSymbolicLink"; Source: "sample.bin"), Found reference to API (Indicator: "KeInitializeTimerEx"; Source: "sample.bin")28:T6f5,Found reference to API " ZwCreateFile" (Indicator: "CreateFile"; Source: "sample.bin"), Found reference to API " ZwCreateFile" (Indicator: "ZwCreateFile"; Source: "sample.bin"), Found reference to API "ZwCreateFile" (Indicator: "CreateFile"; Source: "sample.bin"), Found reference to API "ZwCreateFile" (Indicator: "ZwCreateFile"; Source: "sample.bin"), Found reference to API "IoCreateFileEx" (Indicator: "CreateFile"; Source: "sample.bin"), Found reference to API "NtCreateFile" (Indicator: "CreateFile"; Source: "sample.bin"), Found reference to API "NtCreateFile" (Indicator: "NtCreateFile"; Source: "sample.bin"), Found reference to API "IoCreateFileSpecifyDeviceObjectHint" (Indicator: "CreateFile"; Source: "sample.bin"), Found reference to API "IoCreateFileEx should only be called at IRQL = PASSIVE_LEVEL." (Indicator: "CreateFile"; Source: "sample.bin"), Found reference to API "IoCreateFile should only be called at IRQL = PASSIVE_LEVEL." (Indicator: "CreateFile"; Source: "sample.bin"), Found reference to API "ZwCreateFile should only be called at IRQL = PASSIVE_LEVEL." (Indicator: "CreateFile"; Source: "sample.bin"), Found reference to API "ZwCreateFile should only be called at IRQL = PASSIVE_LEVEL." (Indicator: "ZwCreateFile"; Source: "sample.bin"), Found reference to API "NtCreateFile should only be called at IRQL = PASSIVE_LEVEL." (Indicator: "CreateFile"; Source: "sample.bin"), Found reference to API "NtCreateFile should only be called at IRQL = PASSIVE_LEVEL." (Indicator: "NtCreateFile"; Source: "sample.bin"), Found reference to API "IoCreateFile" (Indicator: "CreateFile"; Source: "sample.bin"), Found reference to API "IoCreateFileSpecifyDeviceObjectHint should only be called at IRQL = PASSIVE_LEVEL." (Indicator: "CreateFile"; Source: "sample.bin")29:T1a0f,"\Registry\Machine\System\CurrentControlSet\Services\wlansvc" in Source: sample.bin, "\Registry\Machine\System\CurrentControlSet\Control\" in Source: sample.bin, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager\Power" in Source: sample.bin, "\Registry\Machine\System\CurrentControlSet\Control\Video" in Source: sample.bin, "\registry\machine\system\currentcontrolset\services\usbhub\uxd_control\policy" in Source: sample.bin, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager\Memory Management" in Source: sample.bin, "\Registry\Machine\System\CurrentControlSet\Control\Storage\StorageTelemetry" in Source: sample.bin, "\Registry\Machine\System\CurrentControlSet\Services\USBHUB\uxd_control\policy" in Source: sample.bin, "\Registry\Machine\System\CurrentControlSet\Control\MiniNt" in Source: sample.bin, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\WUDF" in Source: sample.bin, "\Registry\Machine\System\CurrentControlSet\Services\TPM" in Source: sample.bin, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager\BAM" in Source: sample.bin, "\Registry\Machine\System\CurrentControlSet\Control\IntegrityServices" in Source: sample.bin, "\Registry\Machine\System\CurrentControlSet\Services\" in Source: sample.bin, "\Registry\Machine\System\CurrentControlSet\Services\\hyperkbd\crashdump" in Source: sample.bin, "\Registry\Machine\System\CurrentControlSet\Services\Swenum\Notify" in Source: sample.bin, "\Registry\Machine\System\CurrentControlSet\Control\BitLocker" in Source: sample.bin, "\Registry\Machine\System\CurrentControlSet\Policies\Microsoft\FVE" in Source: sample.bin, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\BitLocker" in Source: sample.bin, "\Registry\Machine\System\CurrentControlSet\Services\hyperkbd\crashdump" in Source: sample.bin, "\Registry\Machine\OSBOOT\System\CurrentControlSet\Services\TPM" in Source: sample.bin, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\Control Panel\Theme" in Source: sample.bin, "\Registry\Machine\System\CurrentControlSet\Services\kbdhid\crashdump" in Source: sample.bin, "\Registry\Machine\System\CurrentControlSet\Services\Swenum\Devices" in Source: sample.bin, "\Registry\Machine\System\CurrentControlSet\Control\FirmwareResources" in Source: sample.bin, "\registry\machine\system\currentcontrolset\services\usbhub\uxd_control\devices" in Source: sample.bin, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\" in Source: sample.bin, "\Registry\Machine\System\CurrentControlSet\Services\VerifierExt\Extensions\" in Source: sample.bin, "\Registry\Machine\System\CurrentControlSet\Control\MediaCategories" in Source: sample.bin, "\Registry\Machine\System\CurrentControlSet\Control\CrashControl" in Source: sample.bin, "\Registry\Machine\Software\Policies\Microsoft\Windows NT\Terminal Services" in Source: sample.bin, "\Registry\Machine\System\CurrentControlSet\Control\Storage\StorageTelemetry\ATA" in Source: sample.bin, "\Registry\Machine\System\CurrentControlSet\Control\Processor" in Source: sample.bin, "\Registry\Machine\System\CurrentControlSet" in Source: sample.bin, "\registry\machine\system\currentcontrolset\services\usbhub\uxd_control\pnp" in Source: sample.bin, "\Registry\Machine\System\CurrentControlSet\Services\USBHUB\uxd_control\devices" in Source: sample.bin, "\Registry\Machine\Software\Microsoft\OEM\Device\Capture" in Source: sample.bin, "\Registry\Machine\OSData\System\CurrentControlSet\Services\wlansvc\Parameters\OEM\SystemCapabilities" in Source: sample.bin, "\Registry\Machine\System\ControlSet001" in Source: sample.bin, "\Registry\Machine\System\CurrentControlSet\Services\i8042prt\crashdump" in Source: sample.bin, "\Registry\Machine\System\CurrentControlSet\Control\GraphicsDrivers" in Source: sample.bin, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Virtualization\HvSocket" in Source: sample.bin, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Virtualization" in Source: sample.bin, "\Registry\Machine\Hardware\Description\System" in Source: sample.bin, "\Registry\Machine\System\CurrentControlSet\Services\bthusb" in Source: sample.bin, "\Registry\Machine\System\CurrentControlSet\Control\Arbiters" in Source: sample.bin, "\Registry\Machine\System\CurrentControlSet\Control" in Source: sample.bin, "\Registry\Machine\System\CurrentControlSet\Control\WMI\GlobalLogger" in Source: sample.bin, "\Registry\Machine\System\CurrentControlSet\Services\Winsock\Parameters" in Source: sample.bin, "\Registry\Machine\System\CurrentControlSet\Services\Wdf01000" in Source: sample.bin, "\Registry\Machine\Software\Policies\Microsoft\Windows\LLTD" in Source: sample.bin, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server\WinStations" in Source: sample.bin, "\Registry\Machine\System\CurrentControlSet\Control\EnhancedStorage" in Source: sample.bin, "\Registry\Machine\System\CurrentControlSet\Services\USBHUB\hubg" in Source: sample.bin, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\WUDF\Services" in Source: sample.bin, "\Registry\Machine\Software\Microsoft\wlansvc" in Source: sample.bin, "\Registry\Machine\System\CurrentControlSet\Control\Ataport" in Source: sample.bin, "\Registry\Machine\System\CurrentControlSet\Control\Lsa\DPL" in Source: sample.bin, "\Registry\Machine\System\CurrentControlSet\Control\Class" in Source: sample.bin, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile" in Source: sample.bin, "\Registry\Machine\System\CurrentControlSet\Control\WppRecorder" in Source: sample.bin, "\Registry\Machine\System\CurrentControlSet\Control\usbflags" in Source: sample.bin, "\Registry\Machine\System\CurrentControlSet\Control\Wdf" in Source: sample.bin, "\Registry\Machine\System\CurrentControlSet\Control\SystemInformation" in Source: sample.bin, "\Registry\Machine\System\CurrentControlSet\Services\Bthport\Parameters" in Source: sample.bin, "\Registry\Machine\System\CurrentControlSet\Control\Power\EnergyEstimation\Storage\HDD" in Source: sample.bin, "\Registry\Machine\System\CurrentControlSet\Services\storflt" in Source: sample.bin, "\Registry\Machine\System\CurrentControlSet\Control\usb" in Source: sample.bin, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\NetworkServiceTriggers" in Source: sample.bin, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine" in Source: sample.bin, "\Registry\Machine\System\CurrentControlSet\Services\USBHUB\uxd_control\pnp" in Source: sample.bin, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Virtualization\Hypervisor" in Source: sample.bin2a:T422,Found reference to "Double OID request detected at MiniportOidRequest." (Indicator: "Oid"; Source: "sample.bin"), Found reference to "Double OID completion detected at MiniportOidRequest." (Indicator: "Oid"; Source: "sample.bin"), Found reference to "OID_DOT11_CONNECT_REQUEST is failed by MiniportOidRequest after NDIS_STATUS_DOT11_CONNECTION_START is inidcated." (Indicator: "Oid"; Source: "sample.bin"), Found reference to "NdisMOidRequestComplete should not be called with 3rd parameter (i.e., Status) as NDIS_STATUS_PENDING." (Indicator: "Oid"; Source: "sample.bin"), Found reference to "OID_DOT11_CONNECT_REQUEST is failed by NdisMOidRequestComplete after NDIS_STATUS_DOT11_CONNECTION_START is inidcated." (Indicator: "Oid"; Source: "sample.bin"), Found reference to "A different OID is being completed at NdisMOidRequestComplete rather than the one previously sent by MiniportOidRequest." (Indicator: "Oid"; Source: "sample.bin"), Found reference to "Double OID completion detected at NdisMOidRequestComplete." (Indicator: "Oid"; Source: "sample.bin")1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"{\"@context\":\"https://schema.org\",\"@type\":\"TechArticle\",\"headline\":\"Sample 451e67ee0541… — Score 0/100 — Hybrid Analysis\",\"description\":\"Threat analysis for sample 451e67ee0541…. Threat score 0/100. 0/28 AV engines flagged this file. 0 malicious and 3 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.\",\"url\":\"/sample/451e67ee0541a357184ce1ef3e35ee609105f972e994e26e8f38b8b1b5a5388d\",\"keywords\":[\"malware analysis\",\"sandbox report\",\"threat intelligence\",\"451e67ee0541a357184ce1ef3e35ee609105f972e994e26e8f38b8b1b5a5388d\"],\"about\":{\"@type\":\"SoftwareApplication\",\"name\":\"VerifierExt.sys\",\"applicationCategory\":[\"peexe\",\"64bits\",\"executable\"],\"identifier\":\"451e67ee0541a357184ce1ef3e35ee609105f972e994e26e8f38b8b1b5a5388d\"},\"threatScore\":0,\"antivirusDetections\":{\"malicious\":0,\"total\":28},\"behavioralIndicators\":{\"malicious\":0,\"suspicious\":3},\"publisher\":{\"@type\":\"Organization\",\"name\":\"Hybrid Analysis\",\"url\":\"https://www.hybrid-analysis.com\"}}"}}],["$","$L25",null,{"initialData":{"schema_version":"1.0.15","sha256":"451e67ee0541a357184ce1ef3e35ee609105f972e994e26e8f38b8b1b5a5388d","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"NOT_AVAILABLE","fastscan_status":"SUCCESS"},"verdict":"no specific threat","threat_score":0,"unified_at_epoch_ms":1792910295812,"unified_at":"2026-10-25T06:38:15.812Z","metadata":{"hashes":{"sha256":"451e67ee0541a357184ce1ef3e35ee609105f972e994e26e8f38b8b1b5a5388d","sha1":"f1a59ad8a673a96568a41a3645a9e9f24487ad1b","md5":"c7ae2104dbbdba96e8ed9a95d6d3b252"},"file_info":{"file_name":"VerifierExt.sys","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit service","file_size":336160,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1792910278000,"last_seen":1792910278000,"last_multi_scan":1792910278000}},"detections":{"summary":{"verdict":"no specific threat","score":0,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":24},"sandbox_signatures":{"informative_count":33,"suspicious_count":3,"malicious_count":0,"total":36},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Impairment","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to use Cryptographic classes"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Able to query registry keys (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Contains ability to delete device driver (API string)"},{"type":"informative","value":"Able to access kernel callback routine (string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Services File Permissions Weakness","attack_id":"T1574.010","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/010","identifiers":[{"type":"suspicious","value":"References security-related Windows services"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"suspicious","value":"Found registry location strings which can modify auto-execute functionality"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Hidden File System","attack_id":"T1564.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/005","identifiers":[{"type":"informative","value":"Contains reference to disk driver parameters"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"NTFS File Attributes","attack_id":"T1564.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/004","identifiers":[{"type":"informative","value":"Contains ability to query/modify extended-attribute values of a file (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","identifiers":[{"type":"suspicious","value":"References suspicious system modules"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Impairment","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]}],"sandbox_signatures":[{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains reference to disk driver parameters","description":"$26","origin":"sample.bin","mitre_attack_id":"T1564.005","id":"string-492","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"ZwQueryKey should only be called at IRQL = PASSIVE_LEVEL.\" in \"sample.bin\", Found registry query API: \"ZwQueryValueKey\" in \"sample.bin\", Found registry query API: \"ZwEnumerateKey\" in \"sample.bin\", Found registry query API: \"ZwQueryKey\" in \"sample.bin\", Found registry query API: \"\nZwEnumerateValueKey\" in \"sample.bin\", Found registry query API: \"\nZwEnumerateKey\" in \"sample.bin\", Found registry query API: \"ZwEnumerateValueKey\" in \"sample.bin\", Found registry query API: \"RtlQueryRegistryValuesEx\" in \"sample.bin\", Found registry query API: \"ZwQueryValueKey should only be called at IRQL = PASSIVE_LEVEL.\" in \"sample.bin\", Found registry query API: \"ZwEnumerateKey should only be called at IRQL = PASSIVE_LEVEL.\" in \"sample.bin\", Found registry query API: \"RtlQueryRegistryValues\" in \"sample.bin\", Found registry query API: \"RtlCheckRegistryKey\" in \"sample.bin\", Found registry query API: \"ZwEnumerateValueKey should only be called at IRQL = PASSIVE_LEVEL.\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-229","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"ZwQueryInformationToken\" (Indicator: \"ZwQueryInformationToken\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134","id":"string-437","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"PsGetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"IoCreateDevice should only be called at IRQL <= APC_LEVEL.\" (Indicator: \"IoCreateDevice\"; Source: \"sample.bin\"), Found reference to API \"IoBuildDeviceIoControlRequest should only be called at IRQL <= APC_LEVEL.\" (Indicator: \"DeviceIoControl\"; Source: \"sample.bin\"), Found reference to API \"IoBuildDeviceIoControlRequest should only be called at IRQL <= APC_LEVEL.\" (Indicator: \"IoBuildDeviceIoControlRequest\"; Source: \"sample.bin\"), Found reference to API \"IoBuildDeviceIoControlRequest\" (Indicator: \"DeviceIoControl\"; Source: \"sample.bin\"), Found reference to API \"IoBuildDeviceIoControlRequest\" (Indicator: \"IoBuildDeviceIoControlRequest\"; Source: \"sample.bin\"), Found reference to API \"IoValidateDeviceIoControlAccess\" (Indicator: \"DeviceIoControl\"; Source: \"sample.bin\"), Found reference to API \"IoCreateDeviceSecure\" (Indicator: \"IoCreateDevice\"; Source: \"sample.bin\"), Found reference to API \"IoCreateDevice\" (Indicator: \"IoCreateDevice\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-220","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$27","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"ZwCreateKey should only be called at IRQL = PASSIVE_LEVEL.\" in \"sample.bin\", Found registry modification API: \"ZwCreateKey\" in \"sample.bin\", Found registry modification API: \"ZwCreateKey is called by %S\n\" in \"sample.bin\", Found registry modification API: \"ZwCreateKeyTransacted should only be called at IRQL = PASSIVE_LEVEL.\" in \"sample.bin\", Found registry modification API: \"\nZwCreateKey\" in \"sample.bin\", Found registry modification API: \"ZwCreateKeyTransacted\" in \"sample.bin\", Found registry modification API: \"\nZwCreateKeyTransacted\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-307","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$28","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-315","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$29","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to query/modify extended-attribute values of a file (API string)","description":"Found reference to API \"ZwSetEaFile should only be called at IRQL = PASSIVE_LEVEL.\" (Indicator: \"ZwSetEaFile\"; Source: \"sample.bin\"), Found reference to API \"ZwSetEaFile\" (Indicator: \"ZwSetEaFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.004","id":"string-268","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"ZwCreateDirectoryObject\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\"), Found reference to API \"ZwCreateDirectoryObject should only be called at IRQL = PASSIVE_LEVEL.\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\"), Found reference to API \"\nZwCreateDirectoryObject\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1074.001","id":"string-423","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"PsSetCreateThreadNotifyRoutine\" (Indicator: \"CreateThread\"; Source: \"sample.bin\"), Found reference to API \"PsSetCreateThreadNotifyRoutine should only be called at IRQL = PASSIVE_LEVEL.\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-161","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"PsSetCreateProcessNotifyRoutine\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\"), Found reference to API \"PsSetCreateProcessNotifyRoutine should only be called at IRQL = PASSIVE_LEVEL.\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-204","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"VerifierExt.pdb\"","origin":"sample.bin","id":"string-7","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"\nZwDeleteValueKey\" in \"sample.bin\", Found registry deletion API: \"ZwDeleteValueKey should only be called at IRQL = PASSIVE_LEVEL.\" in \"sample.bin\", Found registry deletion API: \"ZwDeleteKey\" in \"sample.bin\", Found registry deletion API: \"RtlDeleteRegistryValue\" in \"sample.bin\", Found registry deletion API: \"RtlDeleteRegistryValue should only be called at IRQL = PASSIVE_LEVEL.\" in \"sample.bin\", Found registry deletion API: \"ZwDeleteKey should only be called at IRQL = PASSIVE_LEVEL.\" in \"sample.bin\", Found registry deletion API: \"\nZwDeleteKey\" in \"sample.bin\", Found registry deletion API: \"ZwDeleteValueKey\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-230","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"System Security","name":"References security-related Windows services","description":"\"luafv.sys\" (Indicator: \"luafv\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1574.010","id":"string-43","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"NtWriteFile\" (Indicator: \"NtWriteFile\"; Source: \"sample.bin\"), Found reference to API \"ZwWriteFile\" (Indicator: \"ZwWriteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"\nZwDeleteFile\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\"), Found reference to API \"ZwDeleteFile\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\"), Found reference to API \"ZwDeleteFile should only be called at IRQL = PASSIVE_LEVEL.\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-308","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"ZwSetInformationFile\" (Indicator: \"SetInformationFile\"; Source: \"sample.bin\"), Found reference to API \"ZwSetInformationFile\" (Indicator: \"ZwSetInformationFile\"; Source: \"sample.bin\"), Found reference to API \"NtSetInformationFile\" (Indicator: \"SetInformationFile\"; Source: \"sample.bin\"), Found reference to API \"NtSetInformationFile\" (Indicator: \"NtSetInformationFile\"; Source: \"sample.bin\"), Found reference to API \"NtSetInformationFile should only be called at IRQL = PASSIVE_LEVEL.\" (Indicator: \"SetInformationFile\"; Source: \"sample.bin\"), Found reference to API \"NtSetInformationFile should only be called at IRQL = PASSIVE_LEVEL.\" (Indicator: \"NtSetInformationFile\"; Source: \"sample.bin\"), Found reference to API \"ZwSetInformationFile should only be called at IRQL = PASSIVE_LEVEL.\" (Indicator: \"SetInformationFile\"; Source: \"sample.bin\"), Found reference to API \"ZwSetInformationFile should only be called at IRQL = PASSIVE_LEVEL.\" (Indicator: \"ZwSetInformationFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1222","id":"string-426","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\DosDevices\\VerifierExt\" (Indicator: \"\\DosDevices\\\"; Source: \"sample.bin\"), Found string \"\\Registry\\Machine\\Software\\Microsoft\\OEM\\Device\\Capture\" (Indicator: \"\\Device\\\"; Source: \"sample.bin\"), Found string \"\\Device\\VerifierExt\" (Indicator: \"\\Device\\\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-474","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"ZwQueryInformationToken\" (Indicator: \"ZwQueryInformationToken\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134","id":"string-77","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"RtlAddAccessAllowedAce\" (Indicator: \"AddAccessAllowedAce\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-114","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to delete device driver (API string)","description":"Found reference to API \"IoDeleteDevice should only be called at IRQL <= APC_LEVEL.\" (Indicator: \"IoDeleteDevice\"; Source: \"sample.bin\"), Found reference to API \"IoDeleteDevice\" (Indicator: \"IoDeleteDevice\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1685","id":"string-463","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"KeSetTimer should only be called at IRQL <= DISPATCH_LEVEL.\" (Indicator: \"SetTimer\"; Source: \"sample.bin\"), Found reference to API \"ExSetTimerResolution should only be called at IRQL <= APC_LEVEL.\" (Indicator: \"SetTimer\"; Source: \"sample.bin\"), Found reference to API \"KeQueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\"), Found reference to API \"KeSetTimer\" (Indicator: \"SetTimer\"; Source: \"sample.bin\"), Found reference to API \"KeSetTimerEx\" (Indicator: \"SetTimer\"; Source: \"sample.bin\"), Found reference to API \"KeSetTimerEx should only be called at IRQL <= DISPATCH_LEVEL.\" (Indicator: \"SetTimer\"; Source: \"sample.bin\"), Found reference to API \"ExSetTimerResolution\" (Indicator: \"SetTimer\"; Source: \"sample.bin\"), Found reference to API \"ExSetTimer\" (Indicator: \"SetTimer\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$2a","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-138","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"ZwSetValueKey\" (Indicator: \"ZwSetValueKey\"; Source: \"sample.bin\"), Found reference to API \"ZwSetValueKey should only be called at IRQL = PASSIVE_LEVEL.\" (Indicator: \"ZwSetValueKey\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-304","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to access kernel callback routine (string)","description":"Found reference string \"PsSetCreateThreadNotifyRoutine\" (Indicator: \"pssetcreatethreadnotifyroutine\"; Source: \"sample.bin\"), Found reference string \"PsSetCreateThreadNotifyRoutine should only be called at IRQL = PASSIVE_LEVEL.\" (Indicator: \"pssetcreatethreadnotifyroutine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1685","id":"string-978","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"PsSetCreateThreadNotifyRoutine\" (Indicator: \"CreateThread\"; Source: \"sample.bin\"), Found reference to API \"PsSetCreateThreadNotifyRoutine should only be called at IRQL = PASSIVE_LEVEL.\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-92","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"ZwOpenProcessTokenEx\" (Indicator: \"OpenProcessToken\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-306","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"KeQueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"KeReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"sample.bin\"), Found reference to API \"KeReleaseMutex should only be called at IRQL <= DISPATCH_LEVEL.\" (Indicator: \"ReleaseMutex\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-354","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Unusual Characteristics","name":"References suspicious system modules","description":"Found string \"hal.dll\" (Indicator: \"hal.dll\"; Source: \"sample.bin\"), Found string \"ntoskrnl.exe\" (Indicator: \"ntoskrnl\"; Source: \"sample.bin\"), Found string \"ndis.sys\" (Indicator: \"ndis.sys\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1547.006","id":"string-24","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"IoRaiseHardError should only be called at IRQL <= APC_LEVEL.\" (Indicator: \"RaiseHardError\"; Source: \"sample.bin\"), Found reference to API \"IoRaiseHardError\" (Indicator: \"RaiseHardError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1529","id":"string-189","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"www.microsoft.com/pkiops/docs/repository.htm0\", Pattern match: \"www.microsoft.com/pkiops/crl/microsoft%20development%20pca%202014.crl0j\", Pattern match: \"http://www.microsoft.com/windows0\", Pattern match: \"www.microsoft.com/pkiops/crl/microsoft%20development%20root%20certificate%20authority%202014.crl0\", Pattern match: \"www.microsoft.com/pkiops/certs/microsoft%20development%20pca%202014.crt0\", Pattern match: \"www.microsoft.com/pkiops/certs/microsoft%20development%20root%20certificate%20authority%202014.crt0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"PsGetVersion should only be called at IRQL = PASSIVE_LEVEL.\" (Indicator: \"GetVersion\"; Source: \"sample.bin\"), Found reference to API \"PsGetVersion\" (Indicator: \"GetVersion\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-171","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found registry location strings which can modify auto-execute functionality","description":"Found string \"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa\\DPL\" (Indicator: \"system\\currentcontrolset\\control\\lsa\"; in Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1547","id":"string-184","sources":[{"report_type":"qsp","report_id":""}]}],"intel_graph":{"map":{"File:451e67ee0541a357184ce1ef3e35ee609105f972e994e26e8f38b8b1b5a5388d":{"type":"File","value":"451e67ee0541a357184ce1ef3e35ee609105f972e994e26e8f38b8b1b5a5388d","filetype":"PE32+ executable for MS Windows 10.00 (native), x86-64, 12 sections","filetype_short":"PE64"},"File:bfdb6be7061bb743369c6f02ac11609144fb3ec3dd9c8e8dccb0f183d2e54bb4":{"type":"File","value":"bfdb6be7061bb743369c6f02ac11609144fb3ec3dd9c8e8dccb0f183d2e54bb4","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/octet-stream"}},"chains":[{"id":"1563803831416779431","root":"File:451e67ee0541a357184ce1ef3e35ee609105f972e994e26e8f38b8b1b5a5388d","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:451e67ee0541a357184ce1ef3e35ee609105f972e994e26e8f38b8b1b5a5388d","to_key":"File:bfdb6be7061bb743369c6f02ac11609144fb3ec3dd9c8e8dccb0f183d2e54bb4"}],"verdict":{"verdict":"unknown"}},{"id":"sandbox_files","root":"File:451e67ee0541a357184ce1ef3e35ee609105f972e994e26e8f38b8b1b5a5388d","edges":[{"edge_kind":"extracted","from_key":"File:451e67ee0541a357184ce1ef3e35ee609105f972e994e26e8f38b8b1b5a5388d","to_key":"File:bfdb6be7061bb743369c6f02ac11609144fb3ec3dd9c8e8dccb0f183d2e54bb4"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"bfdb6be7061bb743369c6f02ac11609144fb3ec3dd9c8e8dccb0f183d2e54bb4","sha256":"bfdb6be7061bb743369c6f02ac11609144fb3ec3dd9c8e8dccb0f183d2e54bb4","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]}],"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{}}}]]}] 20:null 24:[["$","title","0",{"children":"Sample 451e67ee0541… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Threat analysis for sample 451e67ee0541…. Threat score 0/100. 0/28 AV engines flagged this file. 0 malicious and 3 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/451e67ee0541a357184ce1ef3e35ee609105f972e994e26e8f38b8b1b5a5388d"}],["$","meta","4",{"property":"og:title","content":"Sample 451e67ee0541… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Threat analysis for sample 451e67ee0541…. Threat score 0/100. 0/28 AV engines flagged this file. 0 malicious and 3 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/451e67ee0541a357184ce1ef3e35ee609105f972e994e26e8f38b8b1b5a5388d"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Sample 451e67ee0541… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Threat analysis for sample 451e67ee0541…. Threat score 0/100. 0/28 AV engines flagged this file. 0 malicious and 3 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2b","11",{}]]