23:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 37:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 24:T5cf,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "d6f7bc7b338e388b3399eb19bb7010ea671131d2e42d94a1bc939cae261ecd90.bin") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "d6f7bc7b338e388b3399eb19bb7010ea671131d2e42d94a1bc939cae261ecd90.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "d6f7bc7b338e388b3399eb19bb7010ea671131d2e42d94a1bc939cae261ecd90.bin") Found reference to API "g____PInvoke|0_0" (Indicator: "FreeLibrary"; File: "d6f7bc7b338e388b3399eb19bb7010ea671131d2e42d94a1bc939cae261ecd90.bin") Found reference to API "g____PInvoke|7_0" (Indicator: "LoadLibrary"; File: "d6f7bc7b338e388b3399eb19bb7010ea671131d2e42d94a1bc939cae261ecd90.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "d6f7bc7b338e388b3399eb19bb7010ea671131d2e42d94a1bc939cae261ecd90.bin") Found reference to API "get_LoadLibraryFailed" (Indicator: "LoadLibrary"; File: "d6f7bc7b338e388b3399eb19bb7010ea671131d2e42d94a1bc939cae261ecd90.bin") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; File: "d6f7bc7b338e388b3399eb19bb7010ea671131d2e42d94a1bc939cae261ecd90.bin") Found reference to API "LoadLibraryWT" (Indicator: "LoadLibrary"; File: "d6f7bc7b338e388b3399eb19bb7010ea671131d2e42d94a1bc939cae261ecd90.bin") Found reference to API "LoadLibraryFailed" (Indicator: "LoadLibrary"; File: "d6f7bc7b338e388b3399eb19bb7010ea671131d2e42d94a1bc939cae261ecd90.bin")25:T147c,Found reference to "CryptoConfigEncodeOIDDiagId" (Indicator: "CryptoConfig"; File: "d6f7bc7b338e388b3399eb19bb7010ea671131d2e42d94a1bc939cae261ecd90.bin") Found reference to "RijndaelDiagId" (Indicator: "Rijndael"; File: "d6f7bc7b338e388b3399eb19bb7010ea671131d2e42d94a1bc939cae261ecd90.bin") Found reference to "LoadFromHashAlgorithmDiagId" (Indicator: "HashAlgorithm"; File: "d6f7bc7b338e388b3399eb19bb7010ea671131d2e42d94a1bc939cae261ecd90.bin") Found reference to "RNGCryptoServiceProviderDiagId" (Indicator: "RNGCryptoServiceProvider"; File: "d6f7bc7b338e388b3399eb19bb7010ea671131d2e42d94a1bc939cae261ecd90.bin") Found reference to "Rfc2898DeriveBytesCtorDiagId" (Indicator: "DeriveBytes"; File: "d6f7bc7b338e388b3399eb19bb7010ea671131d2e42d94a1bc939cae261ecd90.bin") Found reference to "Rfc2898DeriveBytesCtorDiagId" (Indicator: "Rfc2898DeriveBytes"; File: "d6f7bc7b338e388b3399eb19bb7010ea671131d2e42d94a1bc939cae261ecd90.bin") Found reference to "AesGcmTagConstructorDiagId" (Indicator: "Aes"; File: "d6f7bc7b338e388b3399eb19bb7010ea671131d2e42d94a1bc939cae261ecd90.bin") Found reference to "AesGcmTagConstructorDiagId" (Indicator: "AesGcm"; File: "d6f7bc7b338e388b3399eb19bb7010ea671131d2e42d94a1bc939cae261ecd90.bin") Found reference to "CryptoConfigEncodeOIDMessage" (Indicator: "CryptoConfig"; File: "d6f7bc7b338e388b3399eb19bb7010ea671131d2e42d94a1bc939cae261ecd90.bin") Found reference to "RijndaelMessage" (Indicator: "Rijndael"; File: "d6f7bc7b338e388b3399eb19bb7010ea671131d2e42d94a1bc939cae261ecd90.bin") Found reference to "LoadFromHashAlgorithmMessage" (Indicator: "HashAlgorithm"; File: "d6f7bc7b338e388b3399eb19bb7010ea671131d2e42d94a1bc939cae261ecd90.bin") Found reference to "RNGCryptoServiceProviderMessage" (Indicator: "RNGCryptoServiceProvider"; File: "d6f7bc7b338e388b3399eb19bb7010ea671131d2e42d94a1bc939cae261ecd90.bin") Found reference to "Rfc2898DeriveBytesCtorMessage" (Indicator: "DeriveBytes"; File: "d6f7bc7b338e388b3399eb19bb7010ea671131d2e42d94a1bc939cae261ecd90.bin") Found reference to "Rfc2898DeriveBytesCtorMessage" (Indicator: "Rfc2898DeriveBytes"; File: "d6f7bc7b338e388b3399eb19bb7010ea671131d2e42d94a1bc939cae261ecd90.bin") Found reference to "AesGcmTagConstructorMessage" (Indicator: "Aes"; File: "d6f7bc7b338e388b3399eb19bb7010ea671131d2e42d94a1bc939cae261ecd90.bin") Found reference to "AesGcmTagConstructorMessage" (Indicator: "AesGcm"; File: "d6f7bc7b338e388b3399eb19bb7010ea671131d2e42d94a1bc939cae261ecd90.bin") Found reference to "The Rijndael and RijndaelManaged types are obsolete. Use Aes instead." (Indicator: "Aes"; File: "d6f7bc7b338e388b3399eb19bb7010ea671131d2e42d94a1bc939cae261ecd90.bin") Found reference to "The Rijndael and RijndaelManaged types are obsolete. Use Aes instead." (Indicator: "Rijndael"; File: "d6f7bc7b338e388b3399eb19bb7010ea671131d2e42d94a1bc939cae261ecd90.bin") Found reference to "The Rijndael and RijndaelManaged types are obsolete. Use Aes instead." (Indicator: "RijndaelManaged"; File: "d6f7bc7b338e388b3399eb19bb7010ea671131d2e42d94a1bc939cae261ecd90.bin") Found reference to "ProduceLegacyHmacValues is obsolete. Producing legacy HMAC values is not supported." (Indicator: "HMAC"; File: "d6f7bc7b338e388b3399eb19bb7010ea671131d2e42d94a1bc939cae261ecd90.bin") Found reference to "Rfc2898DeriveBytes.CryptDeriveKey is obsolete and is not supported. Use PasswordDeriveBytes.CryptDeriveKey instead." (Indicator: "DeriveBytes"; File: "d6f7bc7b338e388b3399eb19bb7010ea671131d2e42d94a1bc939cae261ecd90.bin") Found reference to "Rfc2898DeriveBytes.CryptDeriveKey is obsolete and is not supported. Use PasswordDeriveBytes.CryptDeriveKey instead." (Indicator: "PasswordDeriveBytes"; File: "d6f7bc7b338e388b3399eb19bb7010ea671131d2e42d94a1bc939cae261ecd90.bin") Found reference to "Rfc2898DeriveBytes.CryptDeriveKey is obsolete and is not supported. Use PasswordDeriveBytes.CryptDeriveKey instead." (Indicator: "Rfc2898DeriveBytes"; File: "d6f7bc7b338e388b3399eb19bb7010ea671131d2e42d94a1bc939cae261ecd90.bin") Found reference to "AssemblyName members HashAlgorithm, ProcessorArchitecture, and VersionCompatibility are obsolete and not supported." (Indicator: "HashAlgorithm"; File: "d6f7bc7b338e388b3399eb19bb7010ea671131d2e42d94a1bc939cae261ecd90.bin") Found reference to "LoadFrom with a custom AssemblyHashAlgorithm is obsolete. Use overloads without an AssemblyHashAlgorithm." (Indicator: "HashAlgorithm"; File: "d6f7bc7b338e388b3399eb19bb7010ea671131d2e42d94a1bc939cae261ecd90.bin") Found reference to "KeyExchangeAlgorithm, KeyExchangeStrength, CipherAlgorithm, CipherStrength, HashAlgorithm and HashStrength properties of SslStream are obsolete. Use NegotiatedCipherSuite instead." (Indicator: "HashAlgorithm"; File: "d6f7bc7b338e388b3399eb19bb7010ea671131d2e42d94a1bc939cae261ecd90.bin") Found reference to "The constructors on Rfc2898DeriveBytes are obsolete. Use the static Pbkdf2 method instead." (Indicator: "DeriveBytes"; File: "d6f7bc7b338e388b3399eb19bb7010ea671131d2e42d94a1bc939cae261ecd90.bin") Found reference to "The constructors on Rfc2898DeriveBytes are obsolete. Use the static Pbkdf2 method instead." (Indicator: "Rfc2898DeriveBytes"; File: "d6f7bc7b338e388b3399eb19bb7010ea671131d2e42d94a1bc939cae261ecd90.bin")26:T52e,Assembly shows XOR instruction xor rcx rsp in Stream UID: 33976-1245-00000001400148AC Assembly shows XOR instruction xor ecx esp in Stream UID: 33976-1245-00000001400148AC Assembly shows XOR instruction xor rax rsp in Stream UID: 33976-1264-0000000140015E3E Assembly shows XOR instruction xor eax esp in Stream UID: 33976-1264-0000000140015E3E Assembly shows XOR instruction xor rcx rsp in Stream UID: 33976-1264-0000000140015E3E Assembly shows XOR instruction xor ecx esp in Stream UID: 33976-1264-0000000140015E3E Assembly shows XOR instruction xor qword ptr [rbp-10h] rax in Stream UID: 33976-1799-0000000140014385 Assembly shows XOR instruction xor dword ptr [rbp-10h] eax in Stream UID: 33976-1799-0000000140014385 Assembly shows XOR instruction xor rax qword ptr [rbp+18h] in Stream UID: 33976-1799-0000000140014385 Assembly shows XOR instruction xor eax dword ptr [rbp+18h] in Stream UID: 33976-1799-0000000140014385 Assembly shows XOR instruction xor rax qword ptr [rbp-10h] in Stream UID: 33976-1799-0000000140014385 Assembly shows XOR instruction xor eax dword ptr [rbp-10h] in Stream UID: 33976-1799-0000000140014385 Assembly shows XOR instruction xor rax rcx in Stream UID: 33976-1799-0000000140014385 Assembly shows XOR instruction xor eax ecx in Stream UID: 33976-1799-000000014001438527:T8e6,Found XOR loop in file "sample.bin" at offset 1084572; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1085037; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1086782; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1087093; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1092599; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1098174; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1124300; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1124495; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1389126; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1898137; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1913743; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1913798; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1917193; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 79831; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 182119; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 406130; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 417202; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 499913; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 769599; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1196903; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1426097; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 365071; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 431529; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 922607; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 924821; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 925877; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 926093; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 926375; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1111239; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1397476; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1764734; code bytes = 803028:T4f8,"g____PInvoke|7_0" (Indicator: "LoadLibrary"; File: "d6f7bc7b338e388b3399eb19bb7010ea671131d2e42d94a1bc939cae261ecd90.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "d6f7bc7b338e388b3399eb19bb7010ea671131d2e42d94a1bc939cae261ecd90.bin") Found reference to API "get_LoadLibraryFailed" (Indicator: "LoadLibrary"; File: "d6f7bc7b338e388b3399eb19bb7010ea671131d2e42d94a1bc939cae261ecd90.bin") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; File: "d6f7bc7b338e388b3399eb19bb7010ea671131d2e42d94a1bc939cae261ecd90.bin") Found reference to API "LoadLibraryWT" (Indicator: "LoadLibrary"; File: "d6f7bc7b338e388b3399eb19bb7010ea671131d2e42d94a1bc939cae261ecd90.bin") Found reference to API "LoadLibraryFailed" (Indicator: "LoadLibrary"; File: "d6f7bc7b338e388b3399eb19bb7010ea671131d2e42d94a1bc939cae261ecd90.bin")2f:T5f7,"g____PInvoke|1_0\" (Indicator: \"GetProcAddress\"; File: \"d6f7bc7b338e388b3399eb19bb7010ea671131d2e42d94a1bc939cae261ecd90.bin\")\n Found reference to API \"g____PInvoke|2_0\" (Indicator: \"GetProcAddress\"; File: \"d6f7bc7b338e388b3399eb19bb7010ea671131d2e42d94a1bc939cae261ecd90.bin\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6a1ab3fefe45aa67260d321f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; File: \"d6f7bc7b338e388b3399eb19bb7010ea671131d2e42d94a1bc939cae261ecd90.bin\")\n Found reference to API \"GetFileAttributesExW\" (Indicator: \"GetFileAttributes\"; File: \"d6f7bc7b338e388b3399eb19bb7010ea671131d2e42d94a1bc939cae261ecd90.bin\")\n Found reference to API \"GetTempPath2W\" (Indicator: \"GetTempPath\"; File: \"d6f7bc7b338e388b3399eb19bb7010ea671131d2e42d94a1bc939cae261ecd90.bin\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6a1ab3fefe45aa67260d321f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve specified item(s) (Powershell command string)","description":"Found string \"-NoProfile -Command \"Get-PhysicalDisk | Select-Object DeviceId\n UniqueId | ConvertTo-Json\"\" (Indicator: \"Get-PhysicalDisk\"; File: \"d6f7bc7b338e388b3399eb19bb7010ea671131d2e42d94a1bc939cae261ecd90.bin\")\n Found string \"Get-Tpm\" (Indicator: \"Get-Tpm\"; File: \"d6f7bc7b338e388b3399eb19bb7010ea671131d2e42d94a1bc939cae261ecd90.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-394","sources":[{"report_type":"sandbox","report_id":"6a1ab3fefe45aa67260d321f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"d6f7bc7b338e388b3399eb19bb7010ea671131d2e42d94a1bc939cae261ecd90.bin\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6a1ab3fefe45aa67260d321f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"d6f7bc7b338e388b3399eb19bb7010ea671131d2e42d94a1bc939cae261ecd90.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6a1ab3fefe45aa67260d321f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"password\" (Indicator: \"password\"; File: \"d6f7bc7b338e388b3399eb19bb7010ea671131d2e42d94a1bc939cae261ecd90.bin\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6a1ab3fefe45aa67260d321f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"$33","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6a1ab3fefe45aa67260d321f"}]},{"level":"informative","category":"System Security","name":"Contains ability to bypass UAC using COM object (API string)","description":"Found reference to API \"CanCallCoGetObjectContext\" (Indicator: \"CoGetObject\"; File: \"d6f7bc7b338e388b3399eb19bb7010ea671131d2e42d94a1bc939cae261ecd90.bin\")","origin":"File/Memory","mitre_attack_id":"T1548.002","relevance":1,"id":"string-239","sources":[{"report_type":"sandbox","report_id":"6a1ab3fefe45aa67260d321f"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files","description":"Observed string: \"\"del \"\" (Indicator: \"\"del \") in Source: d6f7bc7b338e388b3399eb19bb7010ea671131d2e42d94a1bc939cae261ecd90.bin","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-408","sources":[{"report_type":"sandbox","report_id":"6a1ab3fefe45aa67260d321f"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeBackupPrivilege\" (Indicator: \"SeBackupPrivilege\"; File: \"d6f7bc7b338e388b3399eb19bb7010ea671131d2e42d94a1bc939cae261ecd90.bin\")\n Found reference to API \"Elevated: SeBackupPrivilege enabled.\" (Indicator: \"SeBackupPrivilege\"; File: \"d6f7bc7b338e388b3399eb19bb7010ea671131d2e42d94a1bc939cae261ecd90.bin\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6a1ab3fefe45aa67260d321f"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"d6f7bc7b338e388b3399eb19bb7010ea671131d2e42d94a1bc939cae261ecd90.bin\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6a1ab3fefe45aa67260d321f"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeSecurityPrivilege\" (Indicator: \"SeSecurityPrivilege\"; File: \"d6f7bc7b338e388b3399eb19bb7010ea671131d2e42d94a1bc939cae261ecd90.bin\")\n Found reference to API \"Elevated: SeSecurityPrivilege enabled.\" (Indicator: \"SeSecurityPrivilege\"; File: \"d6f7bc7b338e388b3399eb19bb7010ea671131d2e42d94a1bc939cae261ecd90.bin\")","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"6a1ab3fefe45aa67260d321f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6a1ab3fefe45aa67260d321f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"