2a:T46a,Found reference to API "[%s] %s GetModuleHandle ntdll.dll failed" (Indicator: "GetModuleHandle"; Source: "sample.bin"), Found reference to API "[%s] [%s][%s] EnumProcesses FAILED " (Indicator: "EnumProcesses"; Source: "sample.bin"), Found reference to API "GetModuleHandleEx path: %s" (Indicator: "GetModuleHandle"; Source: "sample.bin"), Found reference to API "MemoryScanItem::EnumProcessModules fail! " (Indicator: "EnumProcessModules"; Source: "sample.bin"), Found reference to API "MemoryScanItem::EnumProcessModules success! " (Indicator: "EnumProcessModules"; Source: "sample.bin"), Found reference to API "COsApiImpl::GetProcessList" (Indicator: "ProcessList"; Source: "sample.bin"), Found reference to API "[%s] %s NtWow64QueryInformationProcess64 ProcessBasicInformation failed" (Indicator: "QueryInformationProcess"; Source: "sample.bin"), Found reference to API "GetModuleHandleEx null" (Indicator: "GetModuleHandle"; Source: "sample.bin"), Found reference to API "[%s] %s NtWow64QueryInformationProcess64 or pfnNtWow64ReadVirtualMemory64 addr get failed" (Indicator: "QueryInformationProcess"; Source: "sample.bin")2b:T485,Found reference to API "CEncryptFileUseDriver::CheckFilePointer" (Indicator: "EncryptFile"; Source: "sample.bin"), Found reference to API "CEncryptFileUseDriver::Decrypt8Byte" (Indicator: "EncryptFile"; Source: "sample.bin"), Found reference to API "CEncryptFileUseDriver::Encrypt8Byte" (Indicator: "EncryptFile"; Source: "sample.bin"), Found reference to API "D:\qci_workspace\root-workspaces\__qci-pipeline-11444327-2\modules\security\TAVCommon\TAVEncryptFileUseDriver.cpp" (Indicator: "EncryptFile"; Source: "sample.bin"), Found reference to API "CEncryptFileUseDriver::AddParantPathRights" (Indicator: "EncryptFile"; Source: "sample.bin"), Found reference to API "CEncryptFileUseDriver::EnFileDeFilePieceByPiece" (Indicator: "EncryptFile"; Source: "sample.bin"), Found reference to API "CEncryptFileUseDriver::CreateFileMayRenameOrCreatePath" (Indicator: "EncryptFile"; Source: "sample.bin"), Found reference to API "CEncryptFileUseDriver::oi_symmetry_decrypt2PieceByPiece" (Indicator: "EncryptFile"; Source: "sample.bin"), Found reference to API "CEncryptFileUseDriver::oi_symmetry_encrypt2PieceByPiece" (Indicator: "EncryptFile"; Source: "sample.bin")2c:T47e,Found string - \\.\AntiRk; Source: "sample.bin"), Found string - [a-zA-Z]:(?:\\{1,2}[^\\\/\:\*\?\"\<\>\|]{1,255})*\\{1,2}[^\\\/\:\*\?\"\<\>\|\.]{1,255}(\.[^\\\/\:\*\?\"\<\>\|\.]{0,255})*[^\:\*\?\"\<\>\|\.\s]; Source: "sample.bin"), Found string - (%[^=]{1,255}?%(?:\\{1,2}[^\\\/\:\*\?\"\<\>\|]{1,255})*\\{1,2}[^\\\/\:\*\?\"\<\>\|\s\.]{1,255}(\.[^\\\/\:\*\?\"\<\>\|\.\s]{1,255})*)\s; Source: "sample.bin"), Found string - (?\|]{1,255}\\{1,2})*[^\\\/\:\*\?\"\<\>\|\.]{1,255}(\.[^\\\/\:\*\?\"\<\>\|\.]{0,255})*[^\:\*\?\"\<\>\|\.\s]; Source: "sample.bin"), Found string - \\.\PhysicalDrive; Source: "sample.bin"), Found string - ([a-zA-Z]:(?:\\{1,2}[^\\\/\:\*\?\"\<\>\|]{1,255})*\\{1,2}[^\\\/\:\*\?\"\<\>\|\s\.]{1,255}(\.[^\\\/\:\*\?\"\<\>\|\.\s]{1,255})*)\s; Source: "sample.bin"), Found string - ((?\|]{1,255}\\{1,2})*[^\\\/\:\*\?\"\<\>\|\s]{1,255}(\.[^\\\/\:\*\?\"\<\>\|\.\s]{1,255})?)\s; Source: "sample.bin"), Found string - %[^=]{1,255}?%(?:\\{1,2}[^\\\/\:\*\?\"\<\>\|]{1,255})*\\{1,2}[^\\\/\:\*\?\"\<\>\|\.]{1,255}(\.[^\\\/\:\*\?\"\<\>\|\.]{0,255})*[^\:\*\?\"\<\>\|\.\s]; Source: "sample.bin")