26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 33:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T42c,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious Sample e8636677ce25… — Score 70/100 — Hybrid Analysis","description":"Suspicious verdict for sample e8636677ce25…. Threat score 70/100. 0/28 AV engines flagged this file. 0 malicious and 5 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/e8636677ce25004fee4be84ae22cb2a08e82345d7ce2e2e6e878b4e0d8ed8123","keywords":["Suspicious","malware analysis","sandbox report","threat intelligence","e8636677ce25004fee4be84ae22cb2a08e82345d7ce2e2e6e878b4e0d8ed8123"],"about":{"@type":"SoftwareApplication","name":"TmWSCSvc.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"e8636677ce25004fee4be84ae22cb2a08e82345d7ce2e2e6e878b4e0d8ed8123","additionalType":"Suspicious sample"},"threatScore":70,"antivirusDetections":{"malicious":0,"total":28},"behavioralIndicators":{"malicious":0,"suspicious":5},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T46e,Found reference to API "%s - Calling LoadLibraryW()..." (Indicator: "LoadLibrary"; Source: "sample.bin"), Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "sample.bin"), Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "sample.bin"), Found reference to API "%s - LoadLibrary (%s); ver: (%s)" (Indicator: "LoadLibrary"; Source: "sample.bin"), Found reference to API "[scInitOIPC] LoadLibrary() failed, GetLastError() = %d." (Indicator: "LoadLibrary"; Source: "sample.bin"), Found reference to API "LoadLibraryWithIssuerCheckW" (Indicator: "LoadLibrary"; Source: "sample.bin"), Found reference to API "LoadLibraryWithIssuerCheckA" (Indicator: "LoadLibrary"; Source: "sample.bin"), Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "sample.bin"), Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "sample.bin"), Found reference to API "[CWMIStatus::GetGUIDFromStr] LoadLibrary failed" (Indicator: "LoadLibrary"; Source: "sample.bin"), Found reference to API "%s - Calling LoadLibraryA()..." (Indicator: "LoadLibrary"; Source: "sample.bin")28:Tfa3,Found reference to API "%s - File (%S) is not issued by (%S). Issuer check failed. Write to Windows Event Log, SetLastError() to customized error code ERROR_FAILED_ISSUER_CHECK (0x%08X) and return FALSE." (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API "%s - failed to call WinVerifyTrust(), StatusVerify=%x, GetLastError=%x" (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API "%s - lpIssuerName is NULL. SetLastError() to ERROR_INVALID_PARAMETER and return NULL." (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API "[scCopyFile] CopyFile() from %s to %s failed, GetLastError() = %d" (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API "[scWaitForServiceStatus] OpenSCManager failed, GetLastError() = %d" (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API "[scInitOIPC] LoadLibrary() failed, GetLastError() = %d." (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API "[scStopServiceViaSCM] OpenSCManager failed, GetLastError() = %d" (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API "%s - File (%s) does not exist. SetLastError() to ERROR_FILE_NOT_FOUND and return NULL." (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API "[scGetAppFolderPath] GetModuleFileName() failed, GetLastError() = %d" (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API "%s - Failed to get exe path from lpFullPathApplicationName or lpFullPathCommandLine. SetLastError() to ERROR_INVALID_PARAMETER and return FALSE." (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API "[scStartServiceW] start service(%s) failed, GetLastError() = %d, round %d" (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API "[scStartService] OpenSCManager failed, GetLastError() = %d" (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API "[scCopyNeedfulFiles] reg.QueryStringValue("Application Path") failed, GetLastError() = %d" (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API "[scStartService] OpenService(%s) failed, GetLastError() = %d." (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API "[scWaitForServiceStatus] OpenService(%s) failed, GetLastError() = %d." (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API "[scCopyNeedfulFiles] reg.Open() failed, lRetOpen = %d, GetLastError() = %d" (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API "%s - File (%S) does not exist. SetLastError() to ERROR_FILE_NOT_FOUND and return FALSE." (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API "%s - File (%s) is not issued by (%s). Issuer check failed. Write to Windows Event Log, SetLastError() to customized error code ERROR_FAILED_ISSUER_CHECK (0x%08X) and return NULL." (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API "[scStopServiceViaSCM] OpenService(%s) failed, GetLastError() = %d." (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API "[scStopServiceViaSCM] QueryServiceStatus() FAILED, GetLastError() = %d" (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API "%s - File (%S) is not issued by (%S). Issuer check failed. Write to Windows Event Log, SetLastError() to customized error code ERROR_FAILED_ISSUER_CHECK (0x%08X) and return NULL." (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API "%s - File (%S) does not exist. SetLastError() to ERROR_FILE_NOT_FOUND and return NULL." (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API "%s - lpIssuerName is NULL. SetLastError() to ERROR_INVALID_PARAMETER and return FALSE." (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "sample.bin")29:T55a5,Found reference to API (Indicator: "GetFileAttributesA"; Source: "sample.bin"), Found reference to API (Indicator: "CertGetNameStringW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteFileW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocaleInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThreadpoolWait"; Source: "sample.bin"), Found reference to API (Indicator: "RtlUnwind"; Source: "sample.bin"), Found reference to API (Indicator: "CreateSemaphoreW"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "sample.bin"), Found reference to API (Indicator: "FlushFileBuffers"; Source: "sample.bin"), Found reference to API (Indicator: "FreeSid"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileSizeEx"; Source: "sample.bin"), Found reference to API (Indicator: "SetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "TryEnterCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "PathAppendW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "Process32FirstW"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadpoolWait"; Source: "sample.bin"), Found reference to API (Indicator: "CoInitializeEx"; Source: "sample.bin"), Found reference to API (Indicator: "InitOnceExecuteOnce"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedPushEntrySList"; Source: "sample.bin"), Found reference to API (Indicator: "CloseThreadpoolWait"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextVolumeW"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryW"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryA"; Source: "sample.bin"), Found reference to API (Indicator: "EqualSid"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "sample.bin"), Found reference to API (Indicator: "CryptCATAdminEnumCatalogFromHash"; Source: "sample.bin"), Found reference to API (Indicator: "DeregisterEventSource"; Source: "sample.bin"), Found reference to API (Indicator: "CryptHashData"; Source: "sample.bin"), Found reference to API (Indicator: "CryptDecodeObject"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeSecurityDescriptor"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "sample.bin"), Found reference to API (Indicator: "TlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleA"; Source: "sample.bin"), Found reference to API (Indicator: "CloseServiceHandle"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "SetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetValueExA"; Source: "sample.bin"), Found reference to API (Indicator: "SubmitThreadpoolWork"; Source: "sample.bin"), Found reference to API (Indicator: "PathAddBackslashW"; Source: "sample.bin"), Found reference to API (Indicator: "FormatMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "HeapAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "FlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "sample.bin"), Found reference to API (Indicator: "FlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetFolderPathW"; Source: "sample.bin"), Found reference to API (Indicator: "CertFreeCertificateChain"; Source: "sample.bin"), Found reference to API (Indicator: "CryptCATAdminReleaseContext"; Source: "sample.bin"), Found reference to API (Indicator: "CryptMsgOpenToDecode"; Source: "sample.bin"), Found reference to API (Indicator: "HeapFree"; Source: "sample.bin"), Found reference to API (Indicator: "CryptDecrypt"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemInfo"; Source: "sample.bin"), Found reference to API (Indicator: "CertFreeCertificateContext"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "VerQueryValueA"; Source: "sample.bin"), Found reference to API (Indicator: "FlushProcessWriteBuffers"; Source: "sample.bin"), Found reference to API (Indicator: "VerQueryValueW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeSListHead"; Source: "sample.bin"), Found reference to API (Indicator: "CreateServiceA"; Source: "sample.bin"), Found reference to API (Indicator: "TlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "CryptImportKey"; Source: "sample.bin"), Found reference to API (Indicator: "QueryServiceStatusEx"; Source: "sample.bin"), Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "sample.bin"), Found reference to API (Indicator: "CryptCATAdminCalcHashFromFileHandle"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleMode"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "sample.bin"), Found reference to API (Indicator: "OutputDebugStringW"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessHeap"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "RaiseException"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileExW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileA"; Source: "sample.bin"), Found reference to API (Indicator: "FlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "CryptGetHashParam"; Source: "sample.bin"), Found reference to API (Indicator: "wsprintfA"; Source: "sample.bin"), Found reference to API (Indicator: "CryptCreateHash"; Source: "sample.bin"), Found reference to API (Indicator: "EncodePointer"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThreadpoolWork"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathW"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "LeaveCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "sample.bin"), Found reference to API (Indicator: "CreateSymbolicLinkW"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount64"; Source: "sample.bin"), Found reference to API (Indicator: "EnterCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathA"; Source: "sample.bin"), Found reference to API (Indicator: "GetTokenInformation"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "SizeofResource"; Source: "sample.bin"), Found reference to API (Indicator: "EnumSystemLocalesEx"; Source: "sample.bin"), Found reference to API (Indicator: "ResetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "CryptMsgClose"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "UnmapViewOfFile"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleExW"; Source: "sample.bin"), Found reference to API (Indicator: "CoInitialize"; Source: "sample.bin"), Found reference to API (Indicator: "PathFindFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "CertGetCertificateChain"; Source: "sample.bin"), Found reference to API (Indicator: "GetVolumePathNamesForVolumeNameW"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringEx"; Source: "sample.bin"), Found reference to API (Indicator: "LocaleNameToLCID"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibraryWhenCallbackReturns"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualQuery"; Source: "sample.bin"), Found reference to API (Indicator: "CertCloseStore"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "sample.bin"), Found reference to API (Indicator: "AreFileApisANSI"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenA"; Source: "sample.bin"), Found reference to API (Indicator: "SetSecurityDescriptorDacl"; Source: "sample.bin"), Found reference to API (Indicator: "CryptReleaseContext"; Source: "sample.bin"), Found reference to API (Indicator: "GetDateFormatEx"; Source: "sample.bin"), Found reference to API (Indicator: "CryptUnprotectData"; Source: "sample.bin"), Found reference to API (Indicator: "GetDiskFreeSpaceExW"; Source: "sample.bin"), Found reference to API (Indicator: "SetServiceStatus"; Source: "sample.bin"), Found reference to API (Indicator: "IsValidLocale"; Source: "sample.bin"), Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "sample.bin"), Found reference to API (Indicator: "GetACP"; Source: "sample.bin"), Found reference to API (Indicator: "StartServiceW"; Source: "sample.bin"), Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileInformationByHandleEx"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstVolumeW"; Source: "sample.bin"), Found reference to API (Indicator: "ReadConsoleW"; Source: "sample.bin"), Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "IsValidCodePage"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "InstallELAMCertificateInfo"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesExW"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "FindVolumeClose"; Source: "sample.bin"), Found reference to API (Indicator: "NtQuerySystemInformation"; Source: "sample.bin"), Found reference to API (Indicator: "HeapSize"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessorNumber"; Source: "sample.bin"), Found reference to API (Indicator: "CryptSetKeyParam"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileMappingW"; Source: "sample.bin"), Found reference to API (Indicator: "MapViewOfFile"; Source: "sample.bin"), Found reference to API (Indicator: "WaitNamedPipeW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileType"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCPInfo"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "IsDebuggerPresent"; Source: "sample.bin"), Found reference to API (Indicator: "CryptDestroyKey"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFree"; Source: "sample.bin"), Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "sample.bin"), Found reference to API (Indicator: "EnumSystemLocalesW"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExW"; Source: "sample.bin"), Found reference to API (Indicator: "CopyFileW"; Source: "sample.bin"), Found reference to API (Indicator: "TlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExA"; Source: "sample.bin"), Found reference to API (Indicator: "QueryFullProcessImageNameW"; Source: "sample.bin"), Found reference to API (Indicator: "CryptDestroyHash"; Source: "sample.bin"), Found reference to API (Indicator: "CryptMsgControl"; Source: "sample.bin"), Found reference to API (Indicator: "OpenServiceW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "UuidFromStringW"; Source: "sample.bin"), Found reference to API (Indicator: "PathRemoveFileSpecW"; Source: "sample.bin"), Found reference to API (Indicator: "StartServiceCtrlDispatcherA"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "OpenServiceA"; Source: "sample.bin"), Found reference to API (Indicator: "CertVerifyCertificateChainPolicy"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeConditionVariable"; Source: "sample.bin"), Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetTimeFormatEx"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcess"; Source: "sample.bin"), Found reference to API (Indicator: "QueryDosDeviceW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "CoCreateInstance"; Source: "sample.bin"), Found reference to API (Indicator: "PathStripPathW"; Source: "sample.bin"), Found reference to API (Indicator: "QueryServiceStatus"; Source: "sample.bin"), Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "sample.bin"), Found reference to API (Indicator: "StringFromGUID2"; Source: "sample.bin"), Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "sample.bin"), Found reference to API (Indicator: "TlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersionExA"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileInformationByHandle"; Source: "sample.bin"), Found reference to API (Indicator: "CertGetCertificateContextProperty"; Source: "sample.bin"), Found reference to API (Indicator: "LocalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "SetNamedPipeHandleState"; Source: "sample.bin"), Found reference to API (Indicator: "CreateEventA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateEventW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFinalPathNameByHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualProtect"; Source: "sample.bin"), Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "ChangeServiceConfigA"; Source: "sample.bin"), Found reference to API (Indicator: "PathCanonicalizeW"; Source: "sample.bin"), Found reference to API (Indicator: "TryAcquireSRWLockExclusive"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineW"; Source: "sample.bin"), Found reference to API (Indicator: "CloseThreadpoolWork"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringW"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "DecodePointer"; Source: "sample.bin"), Found reference to API (Indicator: "FlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "CertFindCertificateInStore"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "sample.bin"), Found reference to API (Indicator: "RtlCaptureContext"; Source: "sample.bin"), Found reference to API (Indicator: "LoadResource"; Source: "sample.bin"), Found reference to API (Indicator: "GetOEMCP"; Source: "sample.bin"), Found reference to API (Indicator: "CryptQueryObject"; Source: "sample.bin"), Found reference to API (Indicator: "CertGetEnhancedKeyUsage"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "PathFileExistsW"; Source: "sample.bin"), Found reference to API (Indicator: "RegCreateKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "CryptAcquireContextA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessA"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteService"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "sample.bin"), Found reference to API (Indicator: "RegCreateKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeSRWLock"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringW"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileW"; Source: "sample.bin"), Found reference to API (Indicator: "CryptCATAdminAcquireContext"; Source: "sample.bin"), Found reference to API (Indicator: "IsValidLocaleName"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointerEx"; Source: "sample.bin"), Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "sample.bin"), Found reference to API (Indicator: "Process32NextW"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "WriteConsoleW"; Source: "sample.bin"), Found reference to API (Indicator: "WakeConditionVariable"; Source: "sample.bin"), Found reference to API (Indicator: "CreateEventExW"; Source: "sample.bin"), Found reference to API (Indicator: "RtlPcToFileHeader"; Source: "sample.bin"), Found reference to API (Indicator: "CoUninitialize"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "sample.bin"), Found reference to API (Indicator: "CryptMsgGetParam"; Source: "sample.bin"), Found reference to API (Indicator: "RtlGetVersion"; Source: "sample.bin"), Found reference to API (Indicator: "LockResource"; Source: "sample.bin"), Found reference to API (Indicator: "ControlService"; Source: "sample.bin"), Found reference to API (Indicator: "SleepConditionVariableSRW"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "HeapReAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetStringTypeW"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocalTime"; Source: "sample.bin"), Found reference to API (Indicator: "GetComputerNameA"; Source: "sample.bin"), Found reference to API (Indicator: "OpenSCManagerA"; Source: "sample.bin"), Found reference to API (Indicator: "CryptMsgUpdate"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "OpenSCManagerW"; Source: "sample.bin"), Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "FindResourceW"; Source: "sample.bin"), Found reference to API (Indicator: "LCIDToLocaleName"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "sample.bin")2a:T89a,Found reference to API "%s - OpenSCManager failed (%d)" (Indicator: "OpenSCManager"; Source: "sample.bin"), Found reference to API "%s - failed to QueryServiceStatusEx, err=[%lu]" (Indicator: "QueryServiceStatus"; Source: "sample.bin"), Found reference to API "[scWaitForServiceStatus] OpenSCManager failed, GetLastError() = %d" (Indicator: "OpenSCManager"; Source: "sample.bin"), Found reference to API "[scQueryServiceStatusW] Query service failed [%d]." (Indicator: "QueryServiceStatus"; Source: "sample.bin"), Found reference to API "QueryServiceStatusEx" (Indicator: "QueryServiceStatus"; Source: "sample.bin"), Found reference to API "[scStopServiceViaSCM] OpenSCManager failed, GetLastError() = %d" (Indicator: "OpenSCManager"; Source: "sample.bin"), Found reference to API "[scQueryServiceStatusW] OpenSCMManager failed [%d]." (Indicator: "QueryServiceStatus"; Source: "sample.bin"), Found reference to API "[scQueryServiceStatusW] Open service failed [%d]." (Indicator: "QueryServiceStatus"; Source: "sample.bin"), Found reference to API "%s - OpenSCManager failed, error code = %d" (Indicator: "OpenSCManager"; Source: "sample.bin"), Found reference to API "[scStartService] OpenSCManager failed, GetLastError() = %d" (Indicator: "OpenSCManager"; Source: "sample.bin"), Found reference to API "%s - failed to OpenSCManagerW, err=[%lu]" (Indicator: "OpenSCManager"; Source: "sample.bin"), Found reference to API "%s - failed to OpenSCManager, err=[%d]" (Indicator: "OpenSCManager"; Source: "sample.bin"), Found reference to API "[GetServiceStatus] QueryServiceStatus error = %d" (Indicator: "QueryServiceStatus"; Source: "sample.bin"), Found reference to API "QueryServiceStatus" (Indicator: "QueryServiceStatus"; Source: "sample.bin"), Found reference to API "[scStopServiceViaSCM] QueryServiceStatus() FAILED, GetLastError() = %d" (Indicator: "QueryServiceStatus"; Source: "sample.bin"), Found reference to API "[GetServiceStatus] OpenSCManager error = %d" (Indicator: "OpenSCManager"; Source: "sample.bin"), Found reference to API "OpenSCManagerA" (Indicator: "OpenSCManager"; Source: "sample.bin"), Found reference to API "OpenSCManagerW" (Indicator: "OpenSCManager"; Source: "sample.bin")2b:T5c5,Found reference to API "[scStartServiceW] start service(%s) failed for %d times" (Indicator: "StartService"; Source: "sample.bin"), Found reference to API "[scStartServiceW] start service(%s) failed, GetLastError() = %d, round %d" (Indicator: "StartService"; Source: "sample.bin"), Found reference to API "[scStartService] OpenSCManager failed, GetLastError() = %d" (Indicator: "StartService"; Source: "sample.bin"), Found reference to API "[scStartService] OpenService(%s) failed, GetLastError() = %d." (Indicator: "StartService"; Source: "sample.bin"), Found reference to API "StartServiceW" (Indicator: "StartService"; Source: "sample.bin"), Found reference to API "%s - StartServiceCtrlDispatcher failed (%d)" (Indicator: "StartServiceCtrlDispatcher"; Source: "sample.bin"), Found reference to API "%s - StartServiceCtrlDispatcher failed (%d)" (Indicator: "StartService"; Source: "sample.bin"), Found reference to API "%s - failed to StartServiceW, err=[%lu]" (Indicator: "StartService"; Source: "sample.bin"), Found reference to API "StartServiceCtrlDispatcherA" (Indicator: "StartServiceCtrlDispatcher"; Source: "sample.bin"), Found reference to API "StartServiceCtrlDispatcherA" (Indicator: "StartService"; Source: "sample.bin"), Found reference to API "[scStartServiceW] start service(%s) OK, not verify yet" (Indicator: "StartService"; Source: "sample.bin"), Found reference to API "%s - scStartService dwRetcode = %d" (Indicator: "StartService"; Source: "sample.bin")2c:T718,Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "sample.bin"), Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "sample.bin"), Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "sample.bin"), Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "sample.bin"), Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "sample.bin"), Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "sample.bin"), Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "sample.bin"), Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "sample.bin"), Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "sample.bin"), Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "sample.bin"), Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "sample.bin"), Found reference to API "PathFindFileNameW" (Indicator: "PathFindFileName"; Source: "sample.bin"), Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "sample.bin"), Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "sample.bin"), Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "sample.bin"), Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "sample.bin"), Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "sample.bin"), Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "sample.bin")2d:Tad3,Found api reference "CertGetNameStringW" (Indicator: "CertGetNameStringW"; Source: "sample.bin"), Found api reference "CertGetCertificateChain() indicates invalid sign" (Indicator: "CertGetCertificateChain"; Source: "sample.bin"), Found api reference "CryptHashData" (Indicator: "CryptHashData"; Source: "sample.bin"), Found api reference "CryptDecodeObject" (Indicator: "CryptDecodeObject"; Source: "sample.bin"), Found api reference "%s - failed to call CryptQueryObject(), err=%d" (Indicator: "CryptQueryObject"; Source: "sample.bin"), Found api reference "CertFreeCertificateChain" (Indicator: "CertFreeCertificateChain"; Source: "sample.bin"), Found api reference "CryptMsgOpenToDecode" (Indicator: "CryptMsgOpenToDecode"; Source: "sample.bin"), Found api reference "CryptDecrypt" (Indicator: "CryptDecrypt"; Source: "sample.bin"), Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; Source: "sample.bin"), Found api reference "failed to call CertVerifyCertificateChainPolicy() to verify the chain policy" (Indicator: "CertVerifyCertificateChainPolicy"; Source: "sample.bin"), Found api reference "CryptImportKey" (Indicator: "CryptImportKey"; Source: "sample.bin"), Found api reference "%s - [VerifyACS] check primary signature CryptQueryObject() error (%0x)" (Indicator: "CryptQueryObject"; Source: "sample.bin"), Found api reference "%s - CryptMsgControl() verify signauture error(%0x)" (Indicator: "CryptMsgControl"; Source: "sample.bin"), Found api reference "CryptGetHashParam" (Indicator: "CryptGetHashParam"; Source: "sample.bin"), Found api reference "CryptCreateHash" (Indicator: "CryptCreateHash"; Source: "sample.bin"), Found api reference "failed to call CryptQueryObject() to query digital signature" (Indicator: "CryptQueryObject"; Source: "sample.bin"), Found api reference "CryptMsgClose" (Indicator: "CryptMsgClose"; Source: "sample.bin"), Found api reference "CertGetCertificateChain" (Indicator: "CertGetCertificateChain"; Source: "sample.bin"), Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; Source: "sample.bin"), Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; Source: "sample.bin"), Found api reference "CryptUnprotectData" (Indicator: "CryptUnprotectData"; Source: "sample.bin"), Found api reference "%s - [VerifyACS] (%d/%d) check nested signature CryptQueryObject() error (%0x)" (Indicator: "CryptQueryObject"; Source: "sample.bin"), Found api reference "CryptSetKeyParam" (Indicator: "CryptSetKeyParam"; Source: "sample.bin"), Found api reference "%s - failed to get dwSize by calling CryptMsgGetParam()" (Indicator: "CryptMsgGetParam"; Source: "sample.bin"), Found api reference "CryptDestroyKey" (Indicator: "CryptDestroyKey"; Source: "sample.bin")2e:Taa8,Found reference to API "CertGetNameStringW" (Indicator: "CertGetNameString"; Source: "sample.bin"), Found reference to API "%s - failed to get dwSize by calling CertGetNameString()" (Indicator: "CertGetNameString"; Source: "sample.bin"), Found reference to API "CryptCATAdminEnumCatalogFromHash" (Indicator: "CryptCATAdminEnumCatalogFromHash"; Source: "sample.bin"), Found reference to API "CryptHashData" (Indicator: "CryptHashData"; Source: "sample.bin"), Found reference to API "CryptDecodeObject" (Indicator: "CryptDecodeObject"; Source: "sample.bin"), Found reference to API "CryptCATAdminAcquireContext2" (Indicator: "CryptCATAdminAcquireContext"; Source: "sample.bin"), Found reference to API "CryptCATAdminReleaseContext" (Indicator: "CryptCATAdminReleaseContext"; Source: "sample.bin"), Found reference to API "CryptMsgOpenToDecode" (Indicator: "CryptMsgOpenToDecode"; Source: "sample.bin"), Found reference to API "CryptDecrypt" (Indicator: "CryptDecrypt"; Source: "sample.bin"), Found reference to API "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; Source: "sample.bin"), Found reference to API "CryptImportKey" (Indicator: "CryptImportKey"; Source: "sample.bin"), Found reference to API "CryptCATAdminCalcHashFromFileHandle" (Indicator: "CryptCATAdminCalcHashFromFileHandle"; Source: "sample.bin"), Found reference to API "%s - failed to call CryptCATAdminCalcHashFromFileHandle(), err=%d" (Indicator: "CryptCATAdminCalcHashFromFileHandle"; Source: "sample.bin"), Found reference to API "%s - CryptMsgControl() verify signauture error(%0x)" (Indicator: "CryptMsgControl"; Source: "sample.bin"), Found reference to API "CryptGetHashParam" (Indicator: "CryptGetHashParam"; Source: "sample.bin"), Found reference to API "CryptCreateHash" (Indicator: "CryptCreateHash"; Source: "sample.bin"), Found reference to API "CryptMsgClose" (Indicator: "CryptMsgClose"; Source: "sample.bin"), Found reference to API "CertCloseStore" (Indicator: "CertCloseStore"; Source: "sample.bin"), Found reference to API "CryptReleaseContext" (Indicator: "CryptReleaseContext"; Source: "sample.bin"), Found reference to API "CryptUnprotectData" (Indicator: "CryptUnprotectData"; Source: "sample.bin"), Found reference to API "CryptSetKeyParam" (Indicator: "CryptSetKeyParam"; Source: "sample.bin"), Found reference to API "CryptDestroyKey" (Indicator: "CryptDestroyKey"; Source: "sample.bin"), Found reference to API "%s - failed to CryptMsgOpenToDecode, err=[0x%lx]" (Indicator: "CryptMsgOpenToDecode"; Source: "sample.bin"), Found reference to API "CryptDestroyHash" (Indicator: "CryptDestroyHash"; Source: "sample.bin"), Found reference to API "CryptMsgControl" (Indicator: "CryptMsgControl"; Source: "sample.bin")2f:T439,Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "sample.bin"), Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "sample.bin"), Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "sample.bin"), Found reference to API "%s - GetTokenInformation failed (%d)" (Indicator: "GetTokenInformation"; Source: "sample.bin"), Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "sample.bin"), Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "sample.bin"), Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "sample.bin"), Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "sample.bin"), Found reference to API "%s - AllocateAndInitializeSid failed (%d)" (Indicator: "AllocateAndInitializeSid"; Source: "sample.bin"), Found reference to API "%s - AllocateAndInitializeSid failed (%d)" (Indicator: "InitializeSid"; Source: "sample.bin")30:T451," Trend Micro Common Client