33:"SampleDetailWrapper" 34:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$33"] 3d:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 35:T5dd,Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "sample.bin"), Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "sample.bin"), Found reference to API "SeBackupPrivilege" (Indicator: "SeBackupPrivilege"; Source: "sample.bin"), Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "sample.bin"), Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "sample.bin"), Found reference to API "SeLoadDriverPrivilege" (Indicator: "SeLoadDriverPrivilege"; Source: "sample.bin"), file/memory contains long string with (Indicator: "SeDebugPrivilege"; Source: "sample.bin"), file/memory contains long string with (Indicator: "SeImpersonatePrivilege"; Source: "sample.bin"), file/memory contains long string with (Indicator: "SeBackupPrivilege"; Source: "sample.bin"), file/memory contains long string with (Indicator: "SeLoadDriverPrivilege"; Source: "sample.bin"), file/memory contains long string with (Indicator: "SeShutdownPrivilege"; Source: "sample.bin"), file/memory contains long string with (Indicator: "SeImpersonate"; Source: "sample.bin"), Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "sample.bin"), Found reference to API "SeImpersonatePrivilege" (Indicator: "SeImpersonatePrivilege"; Source: "sample.bin"), Found reference to API "SeImpersonatePrivilege" (Indicator: "SeImpersonate"; Source: "sample.bin")36:Ta0e,Found reference to API "CopySid" (Indicator: "CopySid"; Source: "sample.bin"), Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "sample.bin"), Found reference to API "RtlDeriveCapabilitySidsFromName" (Indicator: "DeriveCapabilitySidsFromName"; Source: "sample.bin"), Found reference to API "AccessCheck" (Indicator: "AccessCheck"; Source: "sample.bin"), Found reference to API "GetSecurityDescriptorOwner" (Indicator: "GetSecurityDescriptorOwner"; Source: "sample.bin"), Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "sample.bin"), Found reference to API "CreateWellKnownSid" (Indicator: "CreateWellKnownSid"; Source: "sample.bin"), Found reference to API "GetSecurityDescriptorGroup" (Indicator: "GetSecurityDescriptorGroup"; Source: "sample.bin"), Found reference to API "GetSecurityDescriptorLength" (Indicator: "GetSecurityDescriptorLength"; Source: "sample.bin"), Found reference to API "RtlAddAccessAllowedAce" (Indicator: "AddAccessAllowedAce"; Source: "sample.bin"), Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; Source: "sample.bin"), Found reference to API "DuplicateToken" (Indicator: "DuplicateToken"; Source: "sample.bin"), Found reference to API "GetAce" (Indicator: "GetAce"; Source: "sample.bin"), Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "sample.bin"), Found reference to API "GetSidIdentifierAuthority" (Indicator: "GetSidIdentifierAuthority"; Source: "sample.bin"), Found reference to API "TaskAccessChecker::TaskAccessChecker" (Indicator: "AccessCheck"; Source: "sample.bin"), Found reference to API "MakeSelfRelativeSD" (Indicator: "MakeSelfRelativeSD"; Source: "sample.bin"), Found reference to API "AddAce" (Indicator: "AddAce"; Source: "sample.bin"), Found reference to API "GetSecurityDescriptorSacl" (Indicator: "GetSecurityDescriptorSacl"; Source: "sample.bin"), Found reference to API "RtlAddAce" (Indicator: "AddAce"; Source: "sample.bin"), Found reference to API "IsValidSid" (Indicator: "IsValidSid"; Source: "sample.bin"), Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; Source: "sample.bin"), Found reference to API "RtlFreeSid" (Indicator: "FreeSid"; Source: "sample.bin"), Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "sample.bin"), Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "sample.bin"), Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "sample.bin")37:T1264,Found reference to API "SeCreateSymbolicLinkPrivilege" (Indicator: "SeCreateSymbolicLinkPrivilege"; Source: "sample.bin"), Found reference to API "SeProfileSingleProcessPrivilege" (Indicator: "SeProfileSingleProcessPrivilege"; Source: "sample.bin"), Found reference to API "SeRestorePrivilege" (Indicator: "SeRestorePrivilege"; Source: "sample.bin"), Found reference to API "SeAuditPrivilege" (Indicator: "SeAuditPrivilege"; Source: "sample.bin"), Found reference to API "SeSystemEnvironmentPrivilege" (Indicator: "SeSystemEnvironmentPrivilege"; Source: "sample.bin"), Found reference to API "SeTrustedCredManAccessPrivilege" (Indicator: "SeTrustedCredManAccessPrivilege"; Source: "sample.bin"), Found reference to API "SeRelabelPrivilege" (Indicator: "SeRelabelPrivilege"; Source: "sample.bin"), Found reference to API "SeDelegateSessionUserImpersonatePrivilege" (Indicator: "SeDelegateSessionUserImpersonatePrivilege"; Source: "sample.bin"), Found reference to API "SeIncreaseBasePriorityPrivilege" (Indicator: "SeIncreaseBasePriorityPrivilege"; Source: "sample.bin"), Found reference to API "SeSecurityPrivilege" (Indicator: "SeSecurityPrivilege"; Source: "sample.bin"), Found reference to API "SeCreatePagefilePrivilege" (Indicator: "SeCreatePagefilePrivilege"; Source: "sample.bin"), Found reference to API "SeManageVolumePrivilege" (Indicator: "SeManageVolumePrivilege"; Source: "sample.bin"), Found reference to API "SeEnableDelegationPrivilege" (Indicator: "SeEnableDelegationPrivilege"; Source: "sample.bin"), Found reference to API "SeSyncAgentPrivilege" (Indicator: "SeSyncAgentPrivilege"; Source: "sample.bin"), Found reference to API "SeTimeZonePrivilege" (Indicator: "SeTimeZonePrivilege"; Source: "sample.bin"), Found reference to API "SeCreatePermanentPrivilege" (Indicator: "SeCreatePermanentPrivilege"; Source: "sample.bin"), Found reference to API "SeSystemProfilePrivilege" (Indicator: "SeSystemProfilePrivilege"; Source: "sample.bin"), Found reference to API "SeLockMemoryPrivilege" (Indicator: "SeLockMemoryPrivilege"; Source: "sample.bin"), Found reference to API "SeMachineAccountPrivilege" (Indicator: "SeMachineAccountPrivilege"; Source: "sample.bin"), file/memory contains long string with (Indicator: "SeTcbPrivilege"; Source: "sample.bin"), file/memory contains long string with (Indicator: "SeIncreaseQuotaPrivilege"; Source: "sample.bin"), file/memory contains long string with (Indicator: "SeChangeNotifyPrivilege"; Source: "sample.bin"), file/memory contains long string with (Indicator: "SeTimeZonePrivilege"; Source: "sample.bin"), file/memory contains long string with (Indicator: "SeCreateGlobalPrivilege"; Source: "sample.bin"), file/memory contains long string with (Indicator: "SeCreatePermanentPrivilege"; Source: "sample.bin"), file/memory contains long string with (Indicator: "SeCreateSymbolicLinkPrivilege"; Source: "sample.bin"), file/memory contains long string with (Indicator: "SeAuditPrivilege"; Source: "sample.bin"), file/memory contains long string with (Indicator: "SeIncreaseWorkingSetPrivilege"; Source: "sample.bin"), file/memory contains long string with (Indicator: "SeIncreaseBasePriorityPrivilege"; Source: "sample.bin"), file/memory contains long string with (Indicator: "SeLockMemoryPrivilege"; Source: "sample.bin"), file/memory contains long string with (Indicator: "SeSecurityPrivilege"; Source: "sample.bin"), file/memory contains long string with (Indicator: "SeSystemEnvironmentPrivilege"; Source: "sample.bin"), file/memory contains long string with (Indicator: "SeManageVolumePrivilege"; Source: "sample.bin"), file/memory contains long string with (Indicator: "SeProfileSingleProcessPrivilege"; Source: "sample.bin"), file/memory contains long string with (Indicator: "SeSystemProfilePrivilege"; Source: "sample.bin"), file/memory contains long string with (Indicator: "SeUndockPrivilege"; Source: "sample.bin"), file/memory contains long string with (Indicator: "SeAssignPrimaryTokenPrivilege"; Source: "sample.bin"), file/memory contains long string with (Indicator: "SeRestorePrivilege"; Source: "sample.bin"), file/memory contains long string with (Indicator: "SeTakeOwnershipPrivilege"; Source: "sample.bin"), Found reference to API "SeUndockPrivilege" (Indicator: "SeUndockPrivilege"; Source: "sample.bin"), Found reference to API "SeCreateGlobalPrivilege" (Indicator: "SeCreateGlobalPrivilege"; Source: "sample.bin"), Found reference to API "SeCreateTokenPrivilege" (Indicator: "SeCreateTokenPrivilege"; Source: "sample.bin"), Found reference to API "SeTcbPrivilege" (Indicator: "SeTcbPrivilege"; Source: "sample.bin"), Found reference to API "SeChangeNotifyPrivilege" (Indicator: "SeChangeNotifyPrivilege"; Source: "sample.bin")38:T5b33,Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "sample.bin"), Found reference to API (Indicator: "BCryptCloseAlgorithmProvider"; Source: "sample.bin"), Found reference to API (Indicator: "RtlReleaseSRWLockExclusive"; Source: "sample.bin"), Found reference to API (Indicator: "NetGetJoinInformation"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteFileW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "CredFree"; Source: "sample.bin"), Found reference to API (Indicator: "RpcStringBindingParseW"; Source: "sample.bin"), Found reference to API (Indicator: "RtlAcquireSRWLockShared"; Source: "sample.bin"), Found reference to API (Indicator: "WTSQuerySessionInformationW"; Source: "sample.bin"), Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "sample.bin"), Found reference to API (Indicator: "CopySid"; Source: "sample.bin"), Found reference to API (Indicator: "LsaConnectUntrusted"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "sample.bin"), Found reference to API (Indicator: "BCryptGetProperty"; Source: "sample.bin"), Found reference to API (Indicator: "RpcBindingVectorFree"; Source: "sample.bin"), Found reference to API (Indicator: "RtlGetOwnerSecurityDescriptor"; Source: "sample.bin"), Found reference to API (Indicator: "UuidToStringW"; Source: "sample.bin"), Found reference to API (Indicator: "FlushFileBuffers"; Source: "sample.bin"), Found reference to API (Indicator: "FreeSid"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileSizeEx"; Source: "sample.bin"), Found reference to API (Indicator: "SetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "AccessCheck"; Source: "sample.bin"), Found reference to API (Indicator: "GetSecurityDescriptorOwner"; Source: "sample.bin"), Found reference to API (Indicator: "RpcBindingToStringBindingW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "RpcServerRegisterIfEx"; Source: "sample.bin"), Found reference to API (Indicator: "CoInitializeEx"; Source: "sample.bin"), Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "sample.bin"), Found reference to API (Indicator: "SetEndOfFile"; Source: "sample.bin"), Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptorW"; Source: "sample.bin"), Found reference to API (Indicator: "RtlGetControlSecurityDescriptor"; Source: "sample.bin"), Found reference to API (Indicator: "EqualSid"; Source: "sample.bin"), Found reference to API (Indicator: "NetApiBufferFree"; Source: "sample.bin"), Found reference to API (Indicator: "OpenEventW"; Source: "sample.bin"), Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "sample.bin"), Found reference to API (Indicator: "GetNamedSecurityInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "ConvertSecurityDescriptorToStringSecurityDescriptorW"; Source: "sample.bin"), Found reference to API (Indicator: "RtlAdjustPrivilege"; Source: "sample.bin"), Found reference to API (Indicator: "CreateWellKnownSid"; Source: "sample.bin"), Found reference to API (Indicator: "GetSecurityDescriptorGroup"; Source: "sample.bin"), Found reference to API (Indicator: "GetSecurityDescriptorLength"; Source: "sample.bin"), Found reference to API (Indicator: "CloseServiceHandle"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "RtlCreateSecurityDescriptor"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "DeviceIoControl"; Source: "sample.bin"), Found reference to API (Indicator: "SubmitThreadpoolWork"; Source: "sample.bin"), Found reference to API (Indicator: "PathAddBackslashW"; Source: "sample.bin"), Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "RtlAddAccessAllowedAce"; Source: "sample.bin"), Found reference to API (Indicator: "CloseThreadpoolCleanupGroupMembers"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "NtQueryInformationToken"; Source: "sample.bin"), Found reference to API (Indicator: "FormatMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "HeapAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "ChangeTimerQueueTimer"; Source: "sample.bin"), Found reference to API (Indicator: "RtlGetDaclSecurityDescriptor"; Source: "sample.bin"), Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThreadpoolCleanupGroup"; Source: "sample.bin"), Found reference to API (Indicator: "RtlLengthSid"; Source: "sample.bin"), Found reference to API (Indicator: "StringFromCLSID"; Source: "sample.bin"), Found reference to API (Indicator: "RtlCreateAcl"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "RpcStringFreeW"; Source: "sample.bin"), Found reference to API (Indicator: "GetDynamicTimeZoneInformation"; Source: "sample.bin"), Found reference to API (Indicator: "RtlSetSecurityObjectEx"; Source: "sample.bin"), Found reference to API (Indicator: "RtlInitUnicodeString"; Source: "sample.bin"), Found reference to API (Indicator: "LsaQueryInformationPolicy"; Source: "sample.bin"), Found reference to API (Indicator: "RpcServerInqDefaultPrincName"; Source: "sample.bin"), Found reference to API (Indicator: "HeapFree"; Source: "sample.bin"), Found reference to API (Indicator: "RtlFindLeastSignificantBit"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "LookupAccountSidLocalW"; Source: "sample.bin"), Found reference to API (Indicator: "RtlNewSecurityObjectEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetSecurityDescriptorControl"; Source: "sample.bin"), Found reference to API (Indicator: "RtlSetGroupSecurityDescriptor"; Source: "sample.bin"), Found reference to API (Indicator: "RtlDllShutdownInProgress"; Source: "sample.bin"), Found reference to API (Indicator: "CoCreateGuid"; Source: "sample.bin"), Found reference to API (Indicator: "RtlReleaseSRWLockShared"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThread"; Source: "sample.bin"), Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; Source: "sample.bin"), Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "sample.bin"), Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "sample.bin"), Found reference to API (Indicator: "RpcServerRegisterAuthInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "LsaFreeMemory"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseSRWLockShared"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileW"; Source: "sample.bin"), Found reference to API (Indicator: "OutputDebugStringW"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessHeap"; Source: "sample.bin"), Found reference to API (Indicator: "RegNotifyChangeKeyValue"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileW"; Source: "sample.bin"), Found reference to API (Indicator: "RpcServerUseProtseqW"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseMutex"; Source: "sample.bin"), Found reference to API (Indicator: "OpenSemaphoreW"; Source: "sample.bin"), Found reference to API (Indicator: "CheckTokenMembership"; Source: "sample.bin"), Found reference to API (Indicator: "DuplicateToken"; Source: "sample.bin"), Found reference to API (Indicator: "WTSQueryUserToken"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThreadpoolWork"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "LeaveCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "CompareFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "CredEnumerateW"; Source: "sample.bin"), Found reference to API (Indicator: "EnterCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetAce"; Source: "sample.bin"), Found reference to API (Indicator: "GetTokenInformation"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateTimerQueueTimer"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "ResetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "RpcServerRegisterAuthInfo"; Source: "sample.bin"), Found reference to API (Indicator: "RegGetValueW"; Source: "sample.bin"), Found reference to API (Indicator: "RpcServerInqBindings"; Source: "sample.bin"), Found reference to API (Indicator: "GetSidIdentifierAuthority"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "RpcEpUnregister"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleExA"; Source: "sample.bin"), Found reference to API (Indicator: "CoInitialize"; Source: "sample.bin"), Found reference to API (Indicator: "RegisterWaitForSingleObjectEx"; Source: "sample.bin"), Found reference to API (Indicator: "RpcServerUnregisterIf"; Source: "sample.bin"), Found reference to API (Indicator: "LookupAccountNameW"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForMultipleObjectsEx"; Source: "sample.bin"), Found reference to API (Indicator: "DebugBreak"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteTimerQueueTimer"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "ConvertSidToStringSidW"; Source: "sample.bin"), Found reference to API (Indicator: "RtlFreeUnicodeString"; Source: "sample.bin"), Found reference to API (Indicator: "RegFlushKey"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenA"; Source: "sample.bin"), Found reference to API (Indicator: "LsaDeregisterLogonProcess"; Source: "sample.bin"), Found reference to API (Indicator: "CoTaskMemFree"; Source: "sample.bin"), Found reference to API (Indicator: "TzSpecificLocalTimeToSystemTime"; Source: "sample.bin"), Found reference to API (Indicator: "NdrServerCallAll"; Source: "sample.bin"), Found reference to API (Indicator: "MakeSelfRelativeSD"; Source: "sample.bin"), Found reference to API (Indicator: "SetServiceStatus"; Source: "sample.bin"), Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "sample.bin"), Found reference to API (Indicator: "EventRegister"; Source: "sample.bin"), Found reference to API (Indicator: "IIDFromString"; Source: "sample.bin"), Found reference to API (Indicator: "LsaFreeReturnBuffer"; Source: "sample.bin"), Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "sample.bin"), Found reference to API (Indicator: "FileTimeToLocalFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileInformationByHandleEx"; Source: "sample.bin"), Found reference to API (Indicator: "RtlLengthSecurityDescriptor"; Source: "sample.bin"), Found reference to API (Indicator: "AcquireSRWLockShared"; Source: "sample.bin"), Found reference to API (Indicator: "CreateWaitableTimer"; Source: "sample.bin"), Found reference to API (Indicator: "DuplicateHandle"; Source: "sample.bin"), Found reference to API (Indicator: "AddAce"; Source: "sample.bin"), Found reference to API (Indicator: "OpenThreadToken"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "RpcServerUnregisterIfEx"; Source: "sample.bin"), Found reference to API (Indicator: "HeapDestroy"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesExW"; Source: "sample.bin"), Found reference to API (Indicator: "RtlSidDominates"; Source: "sample.bin"), Found reference to API (Indicator: "RpcImpersonateClient"; Source: "sample.bin"), Found reference to API (Indicator: "RtlInitializeSRWLock"; Source: "sample.bin"), Found reference to API (Indicator: "AssocQueryStringW"; Source: "sample.bin"), Found reference to API (Indicator: "LsaClose"; Source: "sample.bin"), Found reference to API (Indicator: "BCryptCreateHash"; Source: "sample.bin"), Found reference to API (Indicator: "RtlSetOwnerSecurityDescriptor"; Source: "sample.bin"), Found reference to API (Indicator: "RaiseFailFastException"; Source: "sample.bin"), Found reference to API (Indicator: "GetSecurityDescriptorSacl"; Source: "sample.bin"), Found reference to API (Indicator: "NtPowerInformation"; Source: "sample.bin"), Found reference to API (Indicator: "HeapSize"; Source: "sample.bin"), Found reference to API (Indicator: "UnregisterWaitEx"; Source: "sample.bin"), Found reference to API (Indicator: "BCryptOpenAlgorithmProvider"; Source: "sample.bin"), Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "sample.bin"), Found reference to API (Indicator: "RtlAddAce"; Source: "sample.bin"), Found reference to API (Indicator: "RegEnumKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "NtCreateFile"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "RtlNtStatusToDosErrorNoTeb"; Source: "sample.bin"), Found reference to API (Indicator: "RtlGetGroupSecurityDescriptor"; Source: "sample.bin"), Found reference to API (Indicator: "IsDebuggerPresent"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFree"; Source: "sample.bin"), Found reference to API (Indicator: "LsaOpenPolicy"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExW"; Source: "sample.bin"), Found reference to API (Indicator: "CopyFileW"; Source: "sample.bin"), Found reference to API (Indicator: "QueryFullProcessImageNameW"; Source: "sample.bin"), Found reference to API (Indicator: "IsValidSid"; Source: "sample.bin"), Found reference to API (Indicator: "OpenServiceW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "NtQueryInformationProcess"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteValueW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcess"; Source: "sample.bin"), Found reference to API (Indicator: "UuidEqual"; Source: "sample.bin"), Found reference to API (Indicator: "GetAclInformation"; Source: "sample.bin"), Found reference to API (Indicator: "RtlFreeSid"; Source: "sample.bin"), Found reference to API (Indicator: "ConvertStringSidToSidW"; Source: "sample.bin"), Found reference to API (Indicator: "RtlAbsoluteToSelfRelativeSD"; Source: "sample.bin"), Found reference to API (Indicator: "RtlInitString"; Source: "sample.bin"), Found reference to API (Indicator: "WTSEnumerateSessionsW"; Source: "sample.bin"), Found reference to API (Indicator: "LsaLookupAuthenticationPackage"; Source: "sample.bin"), Found reference to API (Indicator: "RtlDosPathNameToNtPathName_U_WithStatus"; Source: "sample.bin"), Found reference to API (Indicator: "ServicesActive"; Source: "sample.bin"), Found reference to API (Indicator: "HeapSetInformation"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeAcl"; Source: "sample.bin"), Found reference to API (Indicator: "CoCreateInstance"; Source: "sample.bin"), Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "RtlAcquireSRWLockExclusive"; Source: "sample.bin"), Found reference to API (Indicator: "NdrServerCall2"; Source: "sample.bin"), Found reference to API (Indicator: "QueryServiceStatus"; Source: "sample.bin"), Found reference to API (Indicator: "RtlSetDaclSecurityDescriptor"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseSemaphore"; Source: "sample.bin"), Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "sample.bin"), Found reference to API (Indicator: "StringFromGUID2"; Source: "sample.bin"), Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "sample.bin"), Found reference to API (Indicator: "NtSetInformationFile"; Source: "sample.bin"), Found reference to API (Indicator: "GetSidSubAuthority"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersionExW"; Source: "sample.bin"), Found reference to API (Indicator: "RtlGetAce"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileInformationByHandle"; Source: "sample.bin"), Found reference to API (Indicator: "PrivilegeCheck"; Source: "sample.bin"), Found reference to API (Indicator: "LocalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "RpcEpRegister"; Source: "sample.bin"), Found reference to API (Indicator: "CreateEventW"; Source: "sample.bin"), Found reference to API (Indicator: "UuidCreate"; Source: "sample.bin"), Found reference to API (Indicator: "GetFinalPathNameByHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "WTSFreeMemory"; Source: "sample.bin"), Found reference to API (Indicator: "SetWaitableTimerEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetThreadPreferredUILanguages"; Source: "sample.bin"), Found reference to API (Indicator: "IsWellKnownSid"; Source: "sample.bin"), Found reference to API (Indicator: "SearchPathW"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "sample.bin"), Found reference to API (Indicator: "RpcServerInqCallAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateWaitableTimerExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSidSubAuthorityCount"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileInformationByHandle"; Source: "sample.bin"), Found reference to API (Indicator: "CloseThreadpoolWork"; Source: "sample.bin"), Found reference to API (Indicator: "RpcRevertToSelf"; Source: "sample.bin"), Found reference to API (Indicator: "LoadStringW"; Source: "sample.bin"), Found reference to API (Indicator: "RtlAllocateAndInitializeSid"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "DelayLoadFailureHook"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "sample.bin"), Found reference to API (Indicator: "RtlCaptureContext"; Source: "sample.bin"), Found reference to API (Indicator: "RpcServerInqDefaultPrincNameW"; Source: "sample.bin"), Found reference to API (Indicator: "PrivCopyFileExW"; Source: "sample.bin"), Found reference to API (Indicator: "SeDebugPrivilege"; Source: "sample.bin"), Found reference to API (Indicator: "RpcEpRegisterW"; Source: "sample.bin"), Found reference to API (Indicator: "HeapCreate"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "PathFileExistsW"; Source: "sample.bin"), Found reference to API (Indicator: "RegCreateKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "sample.bin"), Found reference to API (Indicator: "BCryptHashData"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeSRWLock"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "GetComputerNameExW"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileW"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "GetSecurityDescriptorDacl"; Source: "sample.bin"), Found reference to API (Indicator: "CLSIDFromString"; Source: "sample.bin"), Found reference to API (Indicator: "CoUninitialize"; Source: "sample.bin"), Found reference to API (Indicator: "RtlCompareMemory"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "CloseThreadpoolCleanupGroup"; Source: "sample.bin"), Found reference to API (Indicator: "BCryptFinishHash"; Source: "sample.bin"), Found reference to API (Indicator: "GetLengthSid"; Source: "sample.bin"), Found reference to API (Indicator: "SleepConditionVariableSRW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateMutexExW"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "HeapReAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "EventUnregister"; Source: "sample.bin"), Found reference to API (Indicator: "GetComputerNameW"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteTreeW"; Source: "sample.bin"), Found reference to API (Indicator: "LsaCallAuthenticationPackage"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadPreferredUILanguages"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "OpenSCManagerW"; Source: "sample.bin"), Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "sample.bin"), Found reference to API (Indicator: "BCryptDestroyHash"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "SeTakeOwnershipPrivilege"; Source: "sample.bin")39:T39e6,"System\CurrentControlSet\Control\Minint" in Source: sample.bin, "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\CredWom" in Source: sample.bin, "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule" in Source: sample.bin, " value="4" valueType="REG_DWORD" /> HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\* [*] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Handlers\* [*] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\CredWom\* [*] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration\* [*] %windir%\System32\Logfiles\SCM\* [*] %windir%\System32\Tasks\* [*] %windir%\System32\Tasks\Microsoft\Windows\UpdateOrchestrator [MusUx_LogonUpdateResults] %windir%\System32\Logfiles\SCM\* [*] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule [HashingCompleted] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Aliases\* [*] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration\* [*] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Maintenance\* [*] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Handlers\* [*]" in Source: sample.bin, "0118009F011F000102000000000005200000002002000000021400FF011F00010100000000000512000000000114009F011F00010100000000000512000000000214001601120001010000000000050B00000000021400160112000101000000000005140000000002140016011200010100000000000513000000000B1400FF011F00010100000000000300000000010100000000000512000000010100000000000512000000" valueType="REG_BINARY" /> HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\* [*] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Handlers\* [*] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\CredWom\* [*] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule [HashingCompleted] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration\* [*] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Maintenance\* [*] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\* [*] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\CredWom\* [*] %windir%\System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\Server [ServerRoleCollector] %windir%\System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\Server [ServerRoleUsageCollector] %windir%\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\* [*] %windir%\System32\Logfiles\SCM\* [scm*] %windir%\Sy" in Source: sample.bin, "tected" path="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule" /> " in Source: sample.bin, "t> %windir%\System32\Tasks\* [*]