26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 3b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4cb,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample f9ff28b32522… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample f9ff28b32522…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 6/25 AV engines flagged this file. 1 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/f9ff28b32522bf4ac0e8f9fa1b392ce43bd26d0b6b70d4c521a2ad67f4a8cbed","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","f9ff28b32522bf4ac0e8f9fa1b392ce43bd26d0b6b70d4c521a2ad67f4a8cbed"],"about":{"@type":"SoftwareApplication","name":"draftview.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"f9ff28b32522bf4ac0e8f9fa1b392ce43bd26d0b6b70d4c521a2ad67f4a8cbed","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":6,"total":25},"behavioralIndicators":{"malicious":1,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T50a,Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "draftview.exe") Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "draftview.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "draftview.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "draftview.exe") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "draftview.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "draftview.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "draftview.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "draftview.exe") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "draftview.exe") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "draftview.exe") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "draftview.exe") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "draftview.exe")28:T586,Found api reference "BCryptGenRandom" (Indicator: "BCryptGenRandom"; File: "draftview.exe") Found api reference "BCryptGenRandom" (Indicator: "CryptGenRandom"; File: "draftview.exe") Found api reference "CertAddCertificateContextToStore" (Indicator: "CertAddCertificateContextToStore"; File: "draftview.exe") Found api reference "CertDuplicateCertificateContext" (Indicator: "CertDuplicateCertificateContext"; File: "draftview.exe") Found api reference "CertGetCertificateChain" (Indicator: "CertGetCertificateChain"; File: "draftview.exe") Found api reference "CertOpenStore" (Indicator: "CertOpenStore"; File: "draftview.exe") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "draftview.exe") Found api reference "CertDuplicateStore" (Indicator: "CertDuplicateStore"; File: "draftview.exe") Found api reference "CertEnumCertificatesInStore" (Indicator: "CertEnumCertificatesInStore"; File: "draftview.exe") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; File: "draftview.exe") Found api reference "CertFreeCertificateChain" (Indicator: "CertFreeCertificateChain"; File: "draftview.exe") Found api reference "CertDuplicateCertificateChain" (Indicator: "CertDuplicateCertificateChain"; File: "draftview.exe") Found api reference "CertVerifyCertificateChainPolicy" (Indicator: "CertVerifyCertificateChainPolicy"; File: "draftview.exe")29:T1974,Assembly shows XOR instruction xor rax rsp in Stream UID: 48993-12743-0000000151973040 Assembly shows XOR instruction xor eax esp in Stream UID: 48993-12743-0000000151973040 Assembly shows XOR instruction xor rcx rsp in Stream UID: 48993-12743-0000000151973040 Assembly shows XOR instruction xor ecx esp in Stream UID: 48993-12743-0000000151973040 Assembly shows XOR instruction xor rax r13 in Stream UID: 48993-12797-0000000151789DF0 Assembly shows XOR instruction xor eax ebp in Stream UID: 48993-12797-0000000151789DF0 Assembly shows XOR instruction xor al 01h in Stream UID: 48993-12797-0000000151789DF0 Assembly shows XOR instruction xor r12L 01h in Stream UID: 48993-12816-0000000151797F80 Assembly shows XOR instruction xor ah 01h in Stream UID: 48993-12816-0000000151797F80 Assembly shows XOR instruction xor al 01h in Stream UID: 48993-12847-000000015178A4F0 Assembly shows XOR instruction xor r11d 0Fh in Stream UID: 48993-13035-00000001515326D9 Assembly shows XOR instruction xor ebx 0Fh in Stream UID: 48993-13035-00000001515326D9 Assembly shows XOR instruction xor eax r15d in Stream UID: 48993-13091-00000001515BB90D Assembly shows XOR instruction xor eax edi in Stream UID: 48993-13091-00000001515BB90D Assembly shows XOR instruction xor edx ebp in Stream UID: 48993-13091-00000001515BB90D Assembly shows XOR instruction xor ebp ebx in Stream UID: 48993-13095-00000001519675F1 Assembly shows XOR instruction xor rdx rax in Stream UID: 48993-13134-00000001515BFA2C Assembly shows XOR instruction xor edx eax in Stream UID: 48993-13134-00000001515BFA2C Assembly shows XOR instruction xor r15d edi in Stream UID: 48993-13216-000000015195D29B Assembly shows XOR instruction xor r12d r13d in Stream UID: 48993-13216-000000015195D29B Assembly shows XOR instruction xor esp ebp in Stream UID: 48993-13216-000000015195D29B Assembly shows XOR instruction xor al cl in Stream UID: 48993-13240-0000000151966EFB Assembly shows XOR instruction xor cl 01h in Stream UID: 48993-13240-0000000151966EFB Assembly shows XOR instruction xor rdx rax in Stream UID: 48993-13323-0000000151987457 Assembly shows XOR instruction xor edx eax in Stream UID: 48993-13323-0000000151987457 Assembly shows XOR instruction xor rcx rax in Stream UID: 48993-13323-0000000151987457 Assembly shows XOR instruction xor ecx eax in Stream UID: 48993-13323-0000000151987457 Assembly shows XOR instruction xor rdx rcx in Stream UID: 48993-13323-0000000151987457 Assembly shows XOR instruction xor edx ecx in Stream UID: 48993-13323-0000000151987457 Assembly shows XOR instruction xor rax rdx in Stream UID: 48993-13323-0000000151987457 Assembly shows XOR instruction xor eax edx in Stream UID: 48993-13323-0000000151987457 Assembly shows XOR instruction xor rax rcx in Stream UID: 48993-13323-0000000151987457 Assembly shows XOR instruction xor eax ecx in Stream UID: 48993-13323-0000000151987457 Assembly shows XOR instruction xor rcx rdx in Stream UID: 48993-13627-000000015178AA80 Assembly shows XOR instruction xor ecx edx in Stream UID: 48993-13627-000000015178AA80 Assembly shows XOR instruction xor r8 r12 in Stream UID: 48993-13627-000000015178AA80 Assembly shows XOR instruction xor eax esp in Stream UID: 48993-13627-000000015178AA80 Assembly shows XOR instruction xor bl 01h in Stream UID: 48993-13650-000000015179E6E9 Assembly shows XOR instruction xor al dl in Stream UID: 48993-13669-00000001517565A7 Assembly shows XOR instruction xor al byte ptr [rsi] in Stream UID: 48993-13669-00000001517565A7 Assembly shows XOR instruction xor al r9L in Stream UID: 48993-13669-00000001517565A7 Assembly shows XOR instruction xor al cl in Stream UID: 48993-13669-00000001517565A7 Assembly shows XOR instruction xor al r10L in Stream UID: 48993-13669-00000001517565A7 Assembly shows XOR instruction xor al byte ptr [rsi+r9] in Stream UID: 48993-13669-00000001517565A7 Assembly shows XOR instruction xor al byte ptr [rsi+rcx] in Stream UID: 48993-13669-00000001517565A7 Assembly shows XOR instruction xor byte ptr [rbx] al in Stream UID: 48993-13805-00000001518EB74D Assembly shows XOR instruction xor dword ptr [rcx+rcx*4+71h] ecx in Stream UID: 48993-13805-00000001518EB74D Assembly shows XOR instruction xor byte ptr [r8-7Dh] cl in Stream UID: 48993-13836-0000000151957166 Assembly shows XOR instruction xor byte ptr [rax-7Dh] cl in Stream UID: 48993-13836-0000000151957166 Assembly shows XOR instruction xor bpl 01h in Stream UID: 48993-13836-0000000151957166 Assembly shows XOR instruction xor ch 01h in Stream UID: 48993-13836-0000000151957166 Assembly shows XOR instruction xor r15L 01h in Stream UID: 48993-13836-0000000151957166 Assembly shows XOR instruction xor bh 01h in Stream UID: 48993-13836-0000000151957166 Assembly shows XOR instruction xor dil 01h in Stream UID: 48993-13836-0000000151957166 Assembly shows XOR instruction xor ebx dword ptr [rbx-76B7087Bh] in Stream UID: 48993-13904-00000001519187D6 Assembly shows XOR instruction xor bpl 01h in Stream UID: 48993-13904-00000001519187D6 Assembly shows XOR instruction xor ch 01h in Stream UID: 48993-13904-00000001519187D6 Assembly shows XOR instruction xor al 01h in Stream UID: 48993-14132-0000000151540598 Assembly shows XOR instruction xor rdx rax in Stream UID: 48993-14620-0000000151562C44 Assembly shows XOR instruction xor edx eax in Stream UID: 48993-14620-0000000151562C44 Assembly shows XOR instruction xor eax 03FEF981h in Stream UID: 48993-14734-00000001515BF5B5 Assembly shows XOR instruction xor bl r14L in Stream UID: 48993-14734-00000001515BF5B5 Assembly shows XOR instruction xor bl dh in Stream UID: 48993-14734-00000001515BF5B5 Assembly shows XOR instruction xor esi 01h in Stream UID: 48993-14791-00000001515BCCDB Assembly shows XOR instruction xor r11 r8 in Stream UID: 48993-19071-000000015165F16B Assembly shows XOR instruction xor ebx eax in Stream UID: 48993-19071-000000015165F16B Assembly shows XOR instruction xor r10 66h in Stream UID: 48993-19071-000000015165F16B Assembly shows XOR instruction xor edx 66h in Stream UID: 48993-19071-000000015165F16B Assembly shows XOR instruction xor eax r8d in Stream UID: 48993-19304-000000015166D4E9 Assembly shows XOR instruction xor rbx 2Fh in Stream UID: 48993-22313-00000001517D1D01 Assembly shows XOR instruction xor ebx 2Fh in Stream UID: 48993-22313-00000001517D1D01 Assembly shows XOR instruction xor al 01h in Stream UID: 48993-22441-000000015170DF102a:T152cb,Found XOR loop in file "sample.bin" at offset 9785; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 833925; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 957445; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 977540; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1020228; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1021885; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1097511; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1787180; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2252435; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2252474; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2429109; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2919065; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2920703; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2923549; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2926273; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2929795; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2932532; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2942901; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2964839; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3655073; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3709123; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3909181; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3937236; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4123921; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4125445; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4128747; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6674373; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7097954; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7618733; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8319993; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8999204; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9012815; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 10261299; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 10318836; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4512799; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4512911; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4585000; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4586197; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4591453; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4594046; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4594771; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4595593; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4598894; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4604168; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4609463; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4609722; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4610500; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4610626; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4614172; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4614411; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4624809; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4625743; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4627415; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4628708; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4628882; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4629326; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4629957; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4631072; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4632084; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4633741; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4634304; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4634921; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4635715; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4635922; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4636212; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4636657; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4637933; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4641365; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4641385; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4645084; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4645243; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4646457; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4648647; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4650235; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4658656; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4659615; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4660410; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4663350; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4664307; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4665994; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4666259; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4667027; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4667478; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4667823; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4670432; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4671470; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4675771; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4677124; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4677153; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4679025; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4681712; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4681945; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4681977; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4683308; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4684725; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4687454; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4688715; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4688806; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4690220; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4690314; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4692850; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4696552; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4697330; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4698083; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4698711; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4699514; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4700796; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4701320; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4703605; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4704200; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4705074; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4709528; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4709867; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4711578; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4716232; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4716285; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4722973; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4725782; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4729883; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4733868; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4734943; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4737177; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4742770; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4743689; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4743825; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4744302; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4745588; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4746573; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4749223; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4754381; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4755208; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4756202; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4757245; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4761593; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4762405; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4762614; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4763475; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4764417; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4764871; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4768210; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4771528; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4772643; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4779133; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4780320; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4781319; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4781736; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4784561; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4788931; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4792072; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4793974; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4794558; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4794705; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4794812; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4796258; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4798748; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4799049; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4803568; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4804594; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4805086; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4806726; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4808300; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4808627; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4813587; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4814694; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4820171; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4822056; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4825866; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4826433; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4827130; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4830343; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4830995; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4832038; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4832041; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4835685; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4836093; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4839094; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4840877; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4841233; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4842209; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4843294; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4843563; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4843932; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4844167; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4844193; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4845639; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4846845; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4852284; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4853363; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4855085; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4856481; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4857467; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4859804; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4860646; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4860984; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4863189; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4866082; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4867003; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4870225; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4875104; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4876525; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4877379; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4877862; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4878631; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4880183; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4881790; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4887114; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4889173; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4891802; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4894947; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4895125; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4896393; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4896830; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4898270; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4898923; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4901538; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4902693; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4903451; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4904036; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4906396; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4907322; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4911595; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4911780; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4911937; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4917179; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4918077; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4920377; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4921952; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4922052; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4923219; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4925362; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4927470; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4928920; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4932834; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4933308; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4933344; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4935495; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4935669; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4940041; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4940470; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4941557; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4943516; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4945996; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4949698; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4958885; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4958940; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4963555; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4964183; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4965432; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4965640; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4965649; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4965891; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4968099; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4969998; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4971870; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4972148; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4976060; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4976797; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4976922; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4977192; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4981424; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4983165; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4983405; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4983525; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4983585; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4985265; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4985275; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4985550; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4987108; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4987206; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4987412; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4988745; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4990457; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4991877; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4996419; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4998211; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5002155; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5003201; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5003497; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5006399; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5010660; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5013225; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5014970; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5015226; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5016274; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5021401; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5023652; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5026186; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5029905; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5030254; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5031177; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5031661; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5032354; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5033798; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5034326; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5035051; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5035618; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5035840; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5039867; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5041111; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5043514; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5046308; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5046440; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5047073; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5048105; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5048594; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5051275; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5053962; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5055485; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5056248; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5059439; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5059618; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5059762; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5061106; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5061483; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5061983; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5062778; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5065194; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5067803; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5068548; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5069539; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5072642; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5073679; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5075323; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5077100; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5077514; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5078394; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5080712; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5080715; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5084911; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5085230; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5086184; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5086425; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5086482; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5086891; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5088194; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5088885; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5089000; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5090722; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5090996; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5092437; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5093015; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5093167; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5096748; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5099928; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5100032; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5100856; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5101909; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5104412; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5106069; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5106504; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5106915; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5109441; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5112852; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5115454; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5115958; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5117432; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5117918; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5121746; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5122286; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5123553; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5123957; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5124237; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5127998; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5128522; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5128603; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5129064; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5138739; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5138910; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5140031; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5143707; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5144537; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5144755; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5147364; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5147467; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5148028; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5149333; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5150102; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5159069; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5159776; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5160234; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5165636; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5168676; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5174998; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5175429; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5176116; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5180298; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5182371; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5182478; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5184246; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5187628; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5188510; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5189907; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5190074; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5193270; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5196367; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5197807; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5198146; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5198704; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5201972; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5202986; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5203871; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5205935; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5205965; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5206779; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5209681; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5209814; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5210345; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5211863; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5212814; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5217001; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5217277; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5219003; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5221359; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5225391; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5225862; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5230428; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5231471; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5234808; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5235801; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5236486; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5236534; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5238207; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5239951; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5241321; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5241684; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5242565; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5243227; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5245169; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5246409; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5253634; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5254459; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5257117; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5260048; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5260483; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5261371; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5263262; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5264298; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5264998; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5266042; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5267149; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5269742; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5270805; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5271498; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5272071; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5276119; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5276701; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5277876; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5280273; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5283855; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5285058; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5286329; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5292228; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5292287; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5292438; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5292908; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5294888; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5295487; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5295623; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5304080; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5304117; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5305367; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5309705; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5312841; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5316659; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5317117; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5320964; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5323343; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5324369; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5325721; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5328172; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5331419; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5332124; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5333727; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5334963; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5336276; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5339164; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5340373; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5342878; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5347149; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5347215; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5351776; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5357512; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5357778; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5359380; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5360128; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5364308; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5364902; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5365896; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5367239; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5368243; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5368875; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5369676; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5372058; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5372572; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5372742; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5374464; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5375784; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5376025; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5379531; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5380332; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5382171; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5383702; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5387217; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5388078; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5389092; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5390326; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5390873; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5391229; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5392970; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5399048; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5399853; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5414125; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5415792; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5415983; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5415992; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5419642; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5420844; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5424586; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5424951; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5427388; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5428036; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5428183; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5430615; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5431041; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5431057; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5432872; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5433000; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5434156; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5436911; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5438657; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5440773; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5440942; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5444245; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5444378; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5444939; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5445205; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5445746; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5446561; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5451974; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5452972; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5454230; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5458695; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5459316; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5463993; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5466881; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5468163; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5468515; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5468940; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5469098; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5469875; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5470926; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5473334; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5474051; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5474988; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5478098; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5485026; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5485720; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5488350; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5489588; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5490037; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5493035; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5493885; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5494283; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5495017; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5496435; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5497651; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5497966; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5498692; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5500005; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5500299; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5500531; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5502693; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5504909; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5505079; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5507182; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5508085; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5513660; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5523697; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5523893; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5525673; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5526290; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5526334; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5527212; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5532630; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5535104; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5535436; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5537340; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5542408; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5543113; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5547739; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5548765; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5551912; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5555402; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5559734; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5560830; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5561098; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5564528; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5565565; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5566396; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5568531; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5569487; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5569756; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5571398; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5573140; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5573906; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5575267; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5576302; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5583322; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5585214; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5588065; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5588353; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5589324; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5589780; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5589792; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5590225; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5595170; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5595808; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5596157; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5598383; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5600151; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5602650; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5602708; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5605773; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5606074; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5606112; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5611092; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5611937; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5612483; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5612544; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5616450; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5622598; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5623469; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5624094; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5629253; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5629469; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5629755; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5631256; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5631998; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5632964; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5637411; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5637855; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5638280; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5644838; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5648942; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5650063; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5650974; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5656471; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5658220; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5659250; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5664541; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5668304; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5669133; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5671951; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5672950; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5674635; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5679646; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5680857; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5681758; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5682393; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5683979; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5684239; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5687368; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5688060; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5690985; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5692186; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5693451; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5697020; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5698578; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5698922; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5699332; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5699908; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5702437; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5703872; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5705044; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5706150; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5709802; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5710129; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5710521; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5711175; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5711322; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5713576; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5715590; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5715818; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5716711; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5724342; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5725113; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5729262; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5729616; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5730442; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5732303; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5733932; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5738752; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5740816; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5742949; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5743893; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5746664; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5747993; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5750736; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5754283; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5756278; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5756296; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5757816; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5759070; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5761282; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5763327; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5763534; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5765614; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5769165; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5770120; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5770545; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5772377; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5773083; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5773582; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5780631; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5781451; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5783823; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5783920; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5785656; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5786818; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5787084; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5789874; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5791867; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5793734; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5794954; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5797121; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5798882; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5801608; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5803374; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5804805; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5806921; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5808137; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5808251; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5809138; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5813799; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5815878; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5817164; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5817572; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5818094; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5818227; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5818775; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5819845; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5820079; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5821001; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5821432; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5822029; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5823793; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5827427; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5828884; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5832657; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5833355; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5834041; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5834908; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5841760; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5842194; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5842729; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5843754; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5844418; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5844948; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5845292; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5848458; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5849090; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5849393; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5850399; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5852802; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5853400; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5856849; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5856872; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5858158; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5875688; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5878804; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5879220; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5880633; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5881134; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5881331; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5884449; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5886191; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5889432; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5889640; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5891226; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5891866; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5893705; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5897325; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5897409; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5898281; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5898967; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5899323; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5901077; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5904662; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5906494; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5910388; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5911085; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5919511; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5919724; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5920011; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5924903; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5926254; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5926536; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5928271; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5934530; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5935866; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5938505; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5939466; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5940617; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5943590; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5944743; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5946221; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5947830; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5948805; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5950691; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5955087; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5957970; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5959538; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5960346; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5961649; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5962220; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5963688; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5964902; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5965362; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5965543; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5967680; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5967683; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5969229; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5969232; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5970193; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5972140; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5972204; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5977555; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5977752; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5980616; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5981186; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5984170; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5984282; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5985344; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5986033; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5986687; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5987002; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5987154; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5988141; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5991000; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5992356; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5997306; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6000445; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6003238; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6003933; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6005507; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6007559; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6012989; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6014419; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6017166; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6017788; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6022011; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6022845; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6022896; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6024971; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6025757; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6029211; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6029937; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6031339; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6031681; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6032034; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6035362; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6036628; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6037272; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6038367; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6038611; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6039790; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6040964; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6041010; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6041110; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6042822; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6042944; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6045023; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6045953; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6046298; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6046561; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6047798; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6049505; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6050343; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6051955; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6053713; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6054323; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6057483; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6057824; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6060439; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6062624; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6062799; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6063336; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6064517; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6066652; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6067959; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6071045; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6076137; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6076451; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6079651; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6079807; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6080090; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6082947; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6083778; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6085945; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6092314; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6092984; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6093483; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6094255; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6098452; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6101075; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6104283; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6105663; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6106413; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6109655; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6110364; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6110891; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6114526; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6114773; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6114888; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6116281; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6117734; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6118233; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6120315; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6121551; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6125178; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6125786; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6127558; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6128231; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6131166; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6138982; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6139691; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6145498; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6145735; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6146007; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6150386; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6150596; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6151551; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6153083; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6155132; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6155924; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6159463; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6164582; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6166570; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6172071; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6172137; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6177658; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6178104; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6181833; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6186100; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6192624; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6195680; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6196964; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6197227; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6197299; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6198240; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6199883; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6201940; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6203613; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6206649; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6208652; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6208975; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6209189; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6210708; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6212005; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6212748; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6219317; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6219902; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6220551; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6223078; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6226659; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6226857; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6226899; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6227852; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6230182; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6231689; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6232470; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6237767; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6239035; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6239445; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6240208; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6240439; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6241903; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6242672; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6242846; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6246290; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6250752; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6252210; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6254663; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6256668; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6258706; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6259309; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6259324; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6259418; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6261577; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6263315; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6263975; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6263981; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6267216; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6268291; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6268646; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6270785; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6270997; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6272068; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6272234; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6275831; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6276758; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6277738; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6278652; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6283749; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6284805; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6286012; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6287173; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6287712; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6288235; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6289403; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6292009; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6296019; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6297142; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6298721; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6299290; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6300851; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6303030; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6304157; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6306181; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6307810; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6311051; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6318262; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6318589; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6319126; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6320376; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6320571; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6320913; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6321858; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6323144; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6325916; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6327232; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6329171; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6333521; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6336304; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6339425; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6339670; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6342326; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6343033; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6346269; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6346375; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6346563; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6348487; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6350390; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6351163; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6353279; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6354258; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6354758; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6355523; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6360739; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6364651; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6365879; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6367292; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6368292; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6371693; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6373283; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6373516; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6378930; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6380102; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6384451; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6385417; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6388985; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6389075; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6389248; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6394215; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6394221; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6397487; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6400062; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6402879; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6402981; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6407125; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6408186; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6408472; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6410256; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6411171; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6411496; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6414016; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6414934; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6416967; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6417735; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6419594; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6423672; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6429349; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6432534; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6433230; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6436963; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6440270; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6441956; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6442423; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6444727; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6444765; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6448653; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6456541; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6458228; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6458557; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6462727; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6465029; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6471002; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6474167; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6474300; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6474705; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6476068; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6477072; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6480657; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6482532; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6486253; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6488486; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6604630; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6842236; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7430094; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7461750; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9116829; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9780913; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 10221793; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 10389907; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 10438726; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 11345902; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 405404; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 471023; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 832993; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 856916; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1310644; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1320888; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1539411; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1618008; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1782276; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2027870; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2028350; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2028830; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2029200; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2029523; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2125579; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2228410; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3227969; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3313381; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3350072; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3357440; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3625347; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3625557; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3625767; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4069502; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4097605; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6549462; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6599852; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6600291; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6600518; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6601249; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6601364; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6601430; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6601593; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6603769; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6646943; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6674240; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6698879; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7189940; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7254118; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7259580; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7270741; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7618730; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7625413; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8415321; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8434352; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9168218; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9624452; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 10261175; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 10407484; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 10661249; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 10839420; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 11182781; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 11182789; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 11339598; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 11341312; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 11350376; code bytes = 80302b:T4f0,"draftview.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005364) "draftview.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005364)2c:T56b,"draftview.exe" called "LoadLibrary" with a parameter vulkan-1.dll (UID: 00000000-00005364) "draftview.exe" called "LoadLibrary" with a parameter d3d12.dll (UID: 00000000-00005364) "draftview.exe" called "LoadLibrary" with a parameter dxgi.dll (UID: 00000000-00005364) "draftview.exe" called "LoadLibrary" with a parameter opengl32.dll (UID: 00000000-00005364) "draftview.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005364) "draftview.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005364) "draftview.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00005364) "draftview.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005364) "draftview.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005364) "draftview.exe" called "LoadLibrary" with a parameter vm3dgl64.dll (UID: 00000000-00005364) "draftview.exe" called "LoadLibrary" with a parameter vm3dglhelper64.dll (UID: 00000000-00005364) "draftview.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005364) "draftview.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00005364) "draftview.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00005364)2d:T2950,"draftview.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter SetThreadDescription (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter CreateDXGIFactory2 (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter CreateDXGIFactory1 (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter DrvValidateVersion (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter DrvSetCallbackProcs (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter DrvCreateContext (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter DrvDeleteContext (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter DrvSetContext (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter DrvReleaseContext (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter DrvCopyContext (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter DrvCreateLayerContext (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter DrvShareLists (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter DrvGetProcAddress (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter DrvDescribeLayerPlane (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter DrvSetLayerPaletteEntries (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter DrvGetLayerPaletteEntries (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter DrvRealizeLayerPalette (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter DrvSwapLayerBuffers (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter DrvSwapMultipleBuffers (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter DrvDescribePixelFormat (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter DrvSetPixelFormat (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter DrvSwapBuffers (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter DrvPresentBuffers (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter VM3DGLHelperInit (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter VM3DGLHelperCleanup (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter VM3DGLHelperGetDevCapMaxCount (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter VM3DGLHelperSetLogLevels (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter VM3DGLHelperLog (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter D3DKMTCreateAllocation (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter D3DKMTDestroyAllocation (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter D3DKMTSetAllocationPriority (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter D3DKMTQueryAllocationResidency (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter D3DKMTQueryResourceInfo (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter D3DKMTOpenResource (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter D3DKMTCreateDevice (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter D3DKMTDestroyDevice (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter D3DKMTQueryAdapterInfo (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter D3DKMTLock (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter D3DKMTUnlock (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter D3DKMTGetDisplayModeList (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter D3DKMTSetDisplayMode (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter D3DKMTGetMultisampleMethodList (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter D3DKMTPresent (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter D3DKMTRender (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter D3DKMTOpenAdapterFromHdc (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter D3DKMTOpenAdapterFromDeviceName (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter D3DKMTCloseAdapter (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter D3DKMTGetSharedPrimaryHandle (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter D3DKMTEscape (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter D3DKMTSetVidPnSourceOwner (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter D3DKMTCreateOverlay (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter D3DKMTUpdateOverlay (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter D3DKMTFlipOverlay (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter D3DKMTDestroyOverlay (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter D3DKMTWaitForVerticalBlankEvent (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter D3DKMTSetGammaRamp (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter D3DKMTGetDeviceState (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter D3DKMTCreateDCFromMemory (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter D3DKMTDestroyDCFromMemory (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter D3DKMTSetContextSchedulingPriority (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter D3DKMTGetContextSchedulingPriority (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter D3DKMTSetProcessSchedulingPriorityClass (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter D3DKMTGetProcessSchedulingPriorityClass (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter D3DKMTReleaseProcessVidPnSourceOwners (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter D3DKMTGetScanLine (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter D3DKMTPollDisplayChildren (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter D3DKMTSetQueuedLimit (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter D3DKMTInvalidateActiveVidPn (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter D3DKMTCheckOcclusion (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter D3DKMTCreateContext (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter D3DKMTDestroyContext (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter D3DKMTCreateSynchronizationObject (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter D3DKMTDestroySynchronizationObject (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter D3DKMTWaitForSynchronizationObject (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter D3DKMTSignalSynchronizationObject (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter D3DKMTCheckMonitorPowerState (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter D3DKMTOpenAdapterFromGdiDisplayName (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter D3DKMTCheckExclusiveOwnership (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter D3DKMTSetDisplayPrivateDriverFormat (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter D3DKMTSharedPrimaryLockNotification (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter D3DKMTSharedPrimaryUnLockNotification (UID: 00000000-00005364) "draftview.exe" called "GetProcAddress" with a parameter AppPolicyGetThreadInitializationType (UID: 00000000-00005364)2e:T4db6,Found reference to API (Indicator: "ConvertSidToStringSidW"; File: "draftview.exe") Found reference to API (Indicator: "ImpersonateAnonymousToken"; File: "draftview.exe") Found reference to API (Indicator: "RegCloseKey"; File: "draftview.exe") Found reference to API (Indicator: "GetTokenInformation"; File: "draftview.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "draftview.exe") Found reference to API (Indicator: "CopySid"; File: "draftview.exe") Found reference to API (Indicator: "IsValidSid"; File: "draftview.exe") Found reference to API (Indicator: "RegOpenKeyExW"; File: "draftview.exe") Found reference to API (Indicator: "RevertToSelf"; File: "draftview.exe") Found reference to API (Indicator: "GetLengthSid"; File: "draftview.exe") Found reference to API (Indicator: "RegQueryValueExW"; File: "draftview.exe") Found reference to API (Indicator: "CreateEventA"; File: "draftview.exe") Found reference to API (Indicator: "PostQueuedCompletionStatus"; File: "draftview.exe") Found reference to API (Indicator: "GlobalMemoryStatusEx"; File: "draftview.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "draftview.exe") Found reference to API (Indicator: "ReadFile"; File: "draftview.exe") Found reference to API (Indicator: "CancelIoEx"; File: "draftview.exe") Found reference to API (Indicator: "FormatMessageW"; File: "draftview.exe") Found reference to API (Indicator: "SetThreadStackGuarantee"; File: "draftview.exe") Found reference to API (Indicator: "CreateThread"; File: "draftview.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "draftview.exe") Found reference to API (Indicator: "LoadLibraryW"; File: "draftview.exe") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; File: "draftview.exe") Found reference to API (Indicator: "InitializeSListHead"; File: "draftview.exe") Found reference to API (Indicator: "GetSystemFirmwareTable"; File: "draftview.exe") Found reference to API (Indicator: "CompareStringOrdinal"; File: "draftview.exe") Found reference to API (Indicator: "WriteFileEx"; File: "draftview.exe") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; File: "draftview.exe") Found reference to API (Indicator: "SetThreadErrorMode"; File: "draftview.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "draftview.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "draftview.exe") Found reference to API (Indicator: "CloseHandle"; File: "draftview.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "draftview.exe") Found reference to API (Indicator: "GetProcessHeap"; File: "draftview.exe") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "draftview.exe") Found reference to API (Indicator: "GlobalFree"; File: "draftview.exe") Found reference to API (Indicator: "CreateMutexA"; File: "draftview.exe") Found reference to API (Indicator: "GlobalLock"; File: "draftview.exe") Found reference to API (Indicator: "SetLastError"; File: "draftview.exe") Found reference to API (Indicator: "FlsSetValue"; File: "draftview.exe") Found reference to API (Indicator: "CopyFileExW"; File: "draftview.exe") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "draftview.exe") Found reference to API (Indicator: "FlsAlloc"; File: "draftview.exe") Found reference to API (Indicator: "HeapReAlloc"; File: "draftview.exe") Found reference to API (Indicator: "LoadLibraryExA"; File: "draftview.exe") Found reference to API (Indicator: "SleepEx"; File: "draftview.exe") Found reference to API (Indicator: "RaiseException"; File: "draftview.exe") Found reference to API (Indicator: "CancelIo"; File: "draftview.exe") Found reference to API (Indicator: "GetEnvironmentVariableW"; File: "draftview.exe") Found reference to API (Indicator: "GetFileInformationByHandleEx"; File: "draftview.exe") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "draftview.exe") Found reference to API (Indicator: "GetModuleHandleA"; File: "draftview.exe") Found reference to API (Indicator: "ExitProcess"; File: "draftview.exe") Found reference to API (Indicator: "CreateDirectoryW"; File: "draftview.exe") Found reference to API (Indicator: "K32GetPerformanceInfo"; File: "draftview.exe") Found reference to API (Indicator: "HeapFree"; File: "draftview.exe") Found reference to API (Indicator: "GetOverlappedResult"; File: "draftview.exe") Found reference to API (Indicator: "CreateWaitableTimerExW"; File: "draftview.exe") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "draftview.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "draftview.exe") Found reference to API (Indicator: "AddVectoredExceptionHandler"; File: "draftview.exe") Found reference to API (Indicator: "GetProcessIoCounters"; File: "draftview.exe") Found reference to API (Indicator: "SwitchToThread"; File: "draftview.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "draftview.exe") Found reference to API (Indicator: "CreateIoCompletionPort"; File: "draftview.exe") Found reference to API (Indicator: "GetStdHandle"; File: "draftview.exe") Found reference to API (Indicator: "CreateFileW"; File: "draftview.exe") Found reference to API (Indicator: "GetQueuedCompletionStatusEx"; File: "draftview.exe") Found reference to API (Indicator: "FindNextFileW"; File: "draftview.exe") Found reference to API (Indicator: "Sleep"; File: "draftview.exe") Found reference to API (Indicator: "SetWaitableTimer"; File: "draftview.exe") Found reference to API (Indicator: "GetFileInformationByHandle"; File: "draftview.exe") Found reference to API (Indicator: "RtlPcToFileHeader"; File: "draftview.exe") Found reference to API (Indicator: "CreateProcessW"; File: "draftview.exe") Found reference to API (Indicator: "GetWindowsDirectoryW"; File: "draftview.exe") Found reference to API (Indicator: "LocalFree"; File: "draftview.exe") Found reference to API (Indicator: "GetProcessTimes"; File: "draftview.exe") Found reference to API (Indicator: "FlsGetValue"; File: "draftview.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "draftview.exe") Found reference to API (Indicator: "GetCurrentThread"; File: "draftview.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "draftview.exe") Found reference to API (Indicator: "ReadFileEx"; File: "draftview.exe") Found reference to API (Indicator: "GetLastError"; File: "draftview.exe") Found reference to API (Indicator: "RtlCaptureContext"; File: "draftview.exe") Found reference to API (Indicator: "lstrlenW"; File: "draftview.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "draftview.exe") Found reference to API (Indicator: "SetFileCompletionNotificationModes"; File: "draftview.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "draftview.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "draftview.exe") Found reference to API (Indicator: "DuplicateHandle"; File: "draftview.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "draftview.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "draftview.exe") Found reference to API (Indicator: "VirtualQueryEx"; File: "draftview.exe") Found reference to API (Indicator: "GlobalUnlock"; File: "draftview.exe") Found reference to API (Indicator: "FlsFree"; File: "draftview.exe") Found reference to API (Indicator: "OpenProcess"; File: "draftview.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "draftview.exe") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "draftview.exe") Found reference to API (Indicator: "FindFirstFileExW"; File: "draftview.exe") Found reference to API (Indicator: "GetSystemTimes"; File: "draftview.exe") Found reference to API (Indicator: "GetFullPathNameW"; File: "draftview.exe") Found reference to API (Indicator: "SetFileTime"; File: "draftview.exe") Found reference to API (Indicator: "SetFileInformationByHandle"; File: "draftview.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "draftview.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "draftview.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "draftview.exe") Found reference to API (Indicator: "HeapAlloc"; File: "draftview.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "draftview.exe") Found reference to API (Indicator: "RemoveVectoredExceptionHandler"; File: "draftview.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "draftview.exe") Found reference to API (Indicator: "FindClose"; File: "draftview.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "draftview.exe") Found reference to API (Indicator: "ReleaseMutex"; File: "draftview.exe") Found reference to API (Indicator: "GlobalSize"; File: "draftview.exe") Found reference to API (Indicator: "DeleteFileW"; File: "draftview.exe") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "draftview.exe") Found reference to API (Indicator: "SetHandleInformation"; File: "draftview.exe") Found reference to API (Indicator: "WriteFile"; File: "draftview.exe") Found reference to API (Indicator: "CreateEventW"; File: "draftview.exe") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "draftview.exe") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "draftview.exe") Found reference to API (Indicator: "GetFileAttributesW"; File: "draftview.exe") Found reference to API (Indicator: "ReadProcessMemory"; File: "draftview.exe") Found reference to API (Indicator: "GetProcAddress"; File: "draftview.exe") Found reference to API (Indicator: "EncodePointer"; File: "draftview.exe") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "draftview.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "draftview.exe") Found reference to API (Indicator: "FreeLibrary"; File: "draftview.exe") Found reference to API (Indicator: "BCryptGenRandom"; File: "draftview.exe") Found reference to API (Indicator: "CertAddCertificateContextToStore"; File: "draftview.exe") Found reference to API (Indicator: "CertDuplicateCertificateContext"; File: "draftview.exe") Found reference to API (Indicator: "CertGetCertificateChain"; File: "draftview.exe") Found reference to API (Indicator: "CertOpenStore"; File: "draftview.exe") Found reference to API (Indicator: "CertFreeCertificateContext"; File: "draftview.exe") Found reference to API (Indicator: "CertDuplicateStore"; File: "draftview.exe") Found reference to API (Indicator: "CertEnumCertificatesInStore"; File: "draftview.exe") Found reference to API (Indicator: "CertCloseStore"; File: "draftview.exe") Found reference to API (Indicator: "CertFreeCertificateChain"; File: "draftview.exe") Found reference to API (Indicator: "CertDuplicateCertificateChain"; File: "draftview.exe") Found reference to API (Indicator: "CertVerifyCertificateChainPolicy"; File: "draftview.exe") Found reference to API (Indicator: "BitBlt"; File: "draftview.exe") Found reference to API (Indicator: "CreateCompatibleDC"; File: "draftview.exe") Found reference to API (Indicator: "DeleteDC"; File: "draftview.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "draftview.exe") Found reference to API (Indicator: "SelectObject"; File: "draftview.exe") Found reference to API (Indicator: "DeleteObject"; File: "draftview.exe") Found reference to API (Indicator: "NtOpenFile"; File: "draftview.exe") Found reference to API (Indicator: "RtlGetVersion"; File: "draftview.exe") Found reference to API (Indicator: "NtQueryInformationProcess"; File: "draftview.exe") Found reference to API (Indicator: "NtQuerySystemInformation"; File: "draftview.exe") Found reference to API (Indicator: "RtlNtStatusToDosError"; File: "draftview.exe") Found reference to API (Indicator: "NtCreateNamedPipeFile"; File: "draftview.exe") Found reference to API (Indicator: "NtReadFile"; File: "draftview.exe") Found reference to API (Indicator: "NtDeviceIoControlFile"; File: "draftview.exe") Found reference to API (Indicator: "NtCreateFile"; File: "draftview.exe") Found reference to API (Indicator: "NtWriteFile"; File: "draftview.exe") Found reference to API (Indicator: "CoUninitialize"; File: "draftview.exe") Found reference to API (Indicator: "CoInitializeEx"; File: "draftview.exe") Found reference to API (Indicator: "OleInitialize"; File: "draftview.exe") Found reference to API (Indicator: "CoCreateInstance"; File: "draftview.exe") Found reference to API (Indicator: "CoTaskMemFree"; File: "draftview.exe") Found reference to API (Indicator: "SysStringLen"; File: "draftview.exe") Found reference to API (Indicator: "GetErrorInfo"; File: "draftview.exe") Found reference to API (Indicator: "SysFreeString"; File: "draftview.exe") Found reference to API (Indicator: "GetModuleFileNameExW"; File: "draftview.exe") Found reference to API (Indicator: "DeleteSecurityContext"; File: "draftview.exe") Found reference to API (Indicator: "AcquireCredentialsHandleA"; File: "draftview.exe") Found reference to API (Indicator: "FreeContextBuffer"; File: "draftview.exe") Found reference to API (Indicator: "DecryptMessage"; File: "draftview.exe") Found reference to API (Indicator: "InitializeSecurityContextW"; File: "draftview.exe") Found reference to API (Indicator: "EncryptMessage"; File: "draftview.exe") Found reference to API (Indicator: "QueryContextAttributesW"; File: "draftview.exe") Found reference to API (Indicator: "FreeCredentialsHandle"; File: "draftview.exe") Found reference to API (Indicator: "AcceptSecurityContext"; File: "draftview.exe") Found reference to API (Indicator: "ApplyControlToken"; File: "draftview.exe") Found reference to API (Indicator: "CommandLineToArgvW"; File: "draftview.exe") Found reference to API (Indicator: "SHGetKnownFolderPath"; File: "draftview.exe") Found reference to API (Indicator: "AssocQueryStringW"; File: "draftview.exe") Found reference to API (Indicator: "LoadCursorW"; File: "draftview.exe") Found reference to API (Indicator: "SetCursorPos"; File: "draftview.exe") Found reference to API (Indicator: "RedrawWindow"; File: "draftview.exe") Found reference to API (Indicator: "SetWindowTextW"; File: "draftview.exe") Found reference to API (Indicator: "CreateWindowExW"; File: "draftview.exe") Found reference to API (Indicator: "ReleaseDC"; File: "draftview.exe") Found reference to API (Indicator: "GetClipboardData"; File: "draftview.exe") Found reference to API (Indicator: "DestroyWindow"; File: "draftview.exe") Found reference to API (Indicator: "SetForegroundWindow"; File: "draftview.exe") Found reference to API (Indicator: "SendInput"; File: "draftview.exe") Found reference to API (Indicator: "RegisterWindowMessageA"; File: "draftview.exe") Found reference to API (Indicator: "GetWindowRect"; File: "draftview.exe") Found reference to API (Indicator: "GetRawInputData"; File: "draftview.exe") Found reference to API (Indicator: "GetMenu"; File: "draftview.exe") Found reference to API (Indicator: "DefWindowProcW"; File: "draftview.exe") Found reference to API (Indicator: "ClientToScreen"; File: "draftview.exe") Found reference to API (Indicator: "EmptyClipboard"; File: "draftview.exe") Found reference to API (Indicator: "ShowCursor"; File: "draftview.exe") Found reference to API (Indicator: "EnableMenuItem"; File: "draftview.exe") Found reference to API (Indicator: "GetDC"; File: "draftview.exe") Found reference to API (Indicator: "GetClientRect"; File: "draftview.exe") Found reference to API (Indicator: "DispatchMessageW"; File: "draftview.exe") Found reference to API (Indicator: "GetKeyboardLayout"; File: "draftview.exe") Found reference to API (Indicator: "SetWindowPlacement"; File: "draftview.exe") Found reference to API (Indicator: "GetForegroundWindow"; File: "draftview.exe") Found reference to API (Indicator: "DestroyCursor"; File: "draftview.exe") Found reference to API (Indicator: "CreateWindowExA"; File: "draftview.exe") Found reference to API (Indicator: "ReleaseCapture"; File: "draftview.exe") Found reference to API (Indicator: "ScreenToClient"; File: "draftview.exe") Found reference to API (Indicator: "GetWindowPlacement"; File: "draftview.exe") Found reference to API (Indicator: "SetClipboardData"; File: "draftview.exe") Found reference to API (Indicator: "GetClipCursor"; File: "draftview.exe") Found reference to API (Indicator: "ClipCursor"; File: "draftview.exe") Found reference to API (Indicator: "GetWindowTextLengthW"; File: "draftview.exe") Found reference to API (Indicator: "CloseClipboard"; File: "draftview.exe") Found reference to API (Indicator: "GetKeyState"; File: "draftview.exe") Found reference to API (Indicator: "SystemParametersInfoA"; File: "draftview.exe") Found reference to API (Indicator: "DestroyIcon"; File: "draftview.exe") Found reference to API (Indicator: "GetKeyboardState"; File: "draftview.exe") Found reference to API (Indicator: "AdjustWindowRectEx"; File: "draftview.exe") Found reference to API (Indicator: "GetSystemMenu"; File: "draftview.exe") Found reference to API (Indicator: "SetCapture"; File: "draftview.exe") Found reference to API (Indicator: "IsIconic"; File: "draftview.exe") Found reference to API (Indicator: "ShowWindow"; File: "draftview.exe") Found reference to API (Indicator: "CreateIconFromResourceEx"; File: "draftview.exe") Found reference to API (Indicator: "ToUnicodeEx"; File: "draftview.exe") Found reference to API (Indicator: "SetWindowPos"; File: "draftview.exe") Found reference to API (Indicator: "PeekMessageW"; File: "draftview.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "draftview.exe") Found reference to API (Indicator: "GetActiveWindow"; File: "draftview.exe") Found reference to API (Indicator: "RegisterClassExA"; File: "draftview.exe") Found reference to API (Indicator: "DefWindowProcA"; File: "draftview.exe") Found reference to API (Indicator: "GetCursorPos"; File: "draftview.exe") Found reference to API (Indicator: "OpenClipboard"; File: "draftview.exe") Found reference to API (Indicator: "TranslateMessage"; File: "draftview.exe") Found reference to API (Indicator: "GetAsyncKeyState"; File: "draftview.exe") Found reference to API (Indicator: "CreateIcon"; File: "draftview.exe") Found reference to API (Indicator: "RegisterRawInputDevices"; File: "draftview.exe") Found reference to API (Indicator: "MsgWaitForMultipleObjectsEx"; File: "draftview.exe") Found reference to API (Indicator: "SetCursor"; File: "draftview.exe") Found reference to API (Indicator: "GetWindowTextW"; File: "draftview.exe") Found reference to API (Indicator: "WSASend"; File: "draftview.exe") Found reference to API (Indicator: "WSAGetLastError"; File: "draftview.exe") Found reference to API (Indicator: "WSAStartup"; File: "draftview.exe") Found reference to API (Indicator: "ioctlsocket"; File: "draftview.exe") Found reference to API (Indicator: "WSAIoctl"; File: "draftview.exe") Found reference to API (Indicator: "getsockopt"; File: "draftview.exe") Found reference to API (Indicator: "getsockname"; File: "draftview.exe") Found reference to API (Indicator: "WSACleanup"; File: "draftview.exe") Found reference to API (Indicator: "closesocket"; File: "draftview.exe") Found reference to API (Indicator: "getpeername"; File: "draftview.exe") Found reference to API (Indicator: "SetProcessDpiAwarenessContext"; File: "draftview.exe") Found reference to API (Indicator: "SetThreadDescription"; Source: "00000000-00005364.00000000.206743.A3B30000.00000004.mdmp, 00000000-00005364.00000001.207901.A3B30000.00000004.mdmp")2f:Tb1b,"#ifdef GL_ES precision mediump float;#endifuniform sampler2D u_sampler;#if NEW_SHADER_INTERFACE in vec4 v_rgba_in_gamma; in vec2 v_tc; out vec4 f_color; // a dirty hack applied to support webGL2 #define gl_FragColor f_color #define texture2D texture#else varying vec4 v_rgba_in_gamma; varying vec2 v_tc;#endif// -----------------------------------------------// Adapted from// https://www.shadertoy.com/view/llVGzG// Originally presented in:// Jimenez 2014, "Next Generation Post-Processing in Call of Duty"//// A good overview can be found in// https://blog.demofox.org/2022/01/01/interleaved-gradient-noise-a-different-kind-of-low-discrepancy-sequence/// via https://github.com/rerun-io/rerun/float interleaved_gradient_noise(vec2 n) { float f = 0.06711056 * n.x + 0.00583715 * n.y; return fract(52.9829189 * fract(f));}vec3 dither_interleaved(vec3 rgb, float levels) { float noise = interleaved_gradient_noise(gl_FragCoord.xy); // scale down the n" (Indicator: "github.com") "// Vertex shader bindingsstruct VertexOutput { @location(0) tex_coord: vec2, @location(1) color: vec4, // gamma 0-1 @builtin(position) position: vec4,};struct Locals { screen_size: vec2, dithering: u32, // 1 if dithering is enabled, 0 otherwise // Uniform buffers need to be at least 16 bytes in WebGL. // See https://github.com/gfx-rs/wgpu/issues/2072 _padding: u32,};@group(0) @binding(0) var r_locals: Locals;// -----------------------------------------------// Adapted from// https://www.shadertoy.com/view/llVGzG// Originally presented in:// Jimenez 2014, "Next Generation Post-Processing in Call of Duty"//// A good overview can be found in// https://blog.demofox.org/2022/01/01/interleaved-gradient-noise-a-different-kind-of-low-discrepancy-sequence/// via https://github.com/rerun-io/rerun/fn interleaved_gradient_noise(n: vec2) -> f32 { let f = 0.06711056 * n.x + 0.00583715 * n.y; return fract(52.9829189 * fract(f));}" (Indicator: "github.com") "Copyright (c) 2018 Source Foundry Authors / Copyright (c) 2003 by Bitstream, Inc. All Rights Reserved.HackRegularSourceFoundry: Hack: 2018Hack RegularVersion 3.003;[3114f1256]-release; ttfautohint (v1.7) -l 6 -r 50 -G 200 -x 10 -H 181 -D latn -f latn -m "Hack-Regular-TA.txt" -w G -W -t -X ""Hack-RegularSource FoundrySource Foundry Authorshttps://github.com/source-foundryhttps://github.com/source-foundry/HackThe work in the Hack project is Copyright 2018 Source Foundry Authors and licensed under the MIT Lice" (Indicator: "github.com") "internal error: entered unreachable Yode: This is validated out until a polyfill is implemented. https://github.com/gfx-rs/wgpu/issues/5276" (Indicator: "github.com") "> arguments yet, see https://github.com/gfx-rs/wgpu/issues/5276" (Indicator: "github.com")30:T754,"draftview.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffcb0d50000 "draftview.exe" loaded module "D3D12.DLL" at base 7ffcbd2c0000 "draftview.exe" loaded module "GDI32.DLL" at base 7ffcdc560000 "draftview.exe" loaded module "DXGI.DLL" at base 7ffcd7150000 "draftview.exe" loaded module "EXT-MS-WIN-CORE-RESOURCEPOLICY-L1-1-0.DLL" at base 7ffcd74b0000 "draftview.exe" loaded module "RPCRT4.DLL" at base 7ffcdc090000 "draftview.exe" loaded module "NTDLL.DLL" at base 7ffcdc5d0000 "draftview.exe" loaded module "OPENGL32.DLL" at base 7ffcb0b20000 "draftview.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffcd7020000 "draftview.exe" loaded module "OPENGL32" at base 7ffcb0b20000 "draftview.exe" loaded module "API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL" at base 7ffcda020000 "draftview.exe" loaded module "%WINDIR%\SYSTEM32\APPXDEPLOYMENTCLIENT.DLL" at base 7ffcd0810000 "draftview.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ffcdb340000 "draftview.exe" loaded module "API-MS-WIN-SECURITY-BASE-L1-1-0.DLL" at base 7ffcd9a70000 "draftview.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffcd9a70000 "draftview.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffcd9a70000 "draftview.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 7ffcd9a70000 "draftview.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffcd9a70000 "draftview.exe" loaded module "KERNEL32" at base 7ffcdbae0000 "draftview.exe" loaded module "VM3DGL64.DLL" at base 7ffca4520000 "draftview.exe" loaded module "VM3DGLHELPER64.DLL" at base 7ffcb5270000 "draftview.exe" loaded module "KERNEL32.DLL" at base 7ffcdbae0000 "draftview.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ffcd8a40000 "draftview.exe" loaded module "EXT-MS-WIN-KERNEL32-ERRORHANDLING-L1-1-0.DLL" at base 7ffcdbae000031:T69b,"draftview.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: ""; Value: "") "draftview.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "draftview.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "draftview.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "") "draftview.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "draftview.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "draftview.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "draftview.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "draftview.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "draftview.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "draftview.exe" (Access type: "OPEN"; Path: "HKLM\OSDATA\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "draftview.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: ""; Value: "") "draftview.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES\MANIFESTEDMERGESTUBSDBS"; Key: ""; Value: "")32:Tafa,"draftview.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "ACP"; Value: "") "draftview.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "OEMCP"; Value: "") "draftview.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "draftview.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "draftview.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "57A6ED1A-79F7-5011-B242-4784E5620CF7"; Value: "") "draftview.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "draftview.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B749553B-D950-5E03-6282-3145A61B1002"; Value: "") "draftview.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "draftview.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "draftview.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "draftview.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "8CCCA27D-F1D8-4DDA-B5DD-339AEE937731"; Value: "") "draftview.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "draftview.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "18608E62-A628-49D9-8C02-55972E097D24"; Value: "") "draftview.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "draftview.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: "SYSMAIN.SDB"; Value: "") "draftview.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: "DISABLEDOUBLEQUERYSDBS"; Value: "") "draftview.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: "SYSMERGE.SDB"; Value: "") "draftview.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "draftview.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "")33:T6b3,"draftview.exe" trying to access non-existent file "C:\dwmapi.dll" "draftview.exe" trying to access non-existent file "C:\bcrypt.dll" "draftview.exe" trying to access non-existent file "C:\uxtheme.dll" "draftview.exe" trying to access non-existent file "C:\d3dcompiler_47.dll" "draftview.exe" trying to access non-existent file "C:\powrprof.dll" "draftview.exe" trying to access non-existent file "C:\CRYPTSP.dll" "draftview.exe" trying to access non-existent file "C:\opengl32.dll" "draftview.exe" trying to access non-existent file "C:\GLU32.dll" "draftview.exe" trying to access non-existent file "C:\pdh.dll" "draftview.exe" trying to access non-existent file "C:\secur32.dll" "draftview.exe" trying to access non-existent file "C:\CRYPTBASE.DLL" "draftview.exe" trying to access non-existent file "C:\SSPICLI.DLL" "draftview.exe" trying to access non-existent file "C:\UMPDC.dll" "draftview.exe" trying to access non-existent file "C:\FLTLIB.DLL" "draftview.exe" trying to access non-existent file "C:\MSVCP140.dll" "draftview.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "draftview.exe" trying to access non-existent file "C:\VCRUNTIME140_1.dll" "draftview.exe" trying to access non-existent file "C:\vulkan-1.dll" "draftview.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\vulkan-1.dll" "draftview.exe" trying to access non-existent file "C:\WINDOWS\system\vulkan-1.dll" "draftview.exe" trying to access non-existent file "C:\WINDOWS\vulkan-1.dll" "draftview.exe" trying to access non-existent file "C:\Program Files (x86)\Common Files\Oracle\Java\javapath\vulkan-1.dll" "draftview.exe" trying to access non-existent file "C:\WINDOWS\system32\vulkan-1.dll"34:Ta6d,Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; File: "draftview.exe") Found reference to API "WSAStartup" (Indicator: "wsastartup"; File: "draftview.exe") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; File: "draftview.exe") Found reference to API "Failed to connect node: code %ld" (Indicator: " connect "; File: "draftview.exe") Found reference to API "Cannot bind pending page" (Indicator: " bind "; File: "draftview.exe") Found reference to API "[%s] create socket (%d)" (Indicator: " socket "; File: "draftview.exe") Found reference to API "Failed to send stream: code %ld" (Indicator: " send "; File: "draftview.exe") Found reference to API "Failed to connect resource: code %ld" (Indicator: " connect "; File: "draftview.exe") Found reference to API "[%s] bind frame (%d)" (Indicator: " bind "; File: "draftview.exe") Found reference to API "[%s] open socket (%d)" (Indicator: " socket "; File: "draftview.exe") Found reference to API "Failed to bind callback: code %ld" (Indicator: " bind "; File: "draftview.exe") Found reference to API "[%s] merge socket (%d)" (Indicator: " socket "; File: "draftview.exe") Found reference to API "Failed to connect socket: code %ld" (Indicator: " connect "; File: "draftview.exe") Found reference to API "Cannot connect started channel" (Indicator: " connect "; File: "draftview.exe") Found reference to API "[%s] send entry (%d)" (Indicator: " send "; File: "draftview.exe") Found reference to API "sFailed to send task: code %ld" (Indicator: " send "; File: "draftview.exe") Found reference to API "Cannot bind stopped entry" (Indicator: " bind "; File: "draftview.exe") Found reference to API "[%s] cancel socket (%d)" (Indicator: " socket "; File: "draftview.exe") Found reference to API "Failed to bind frame: code %ld" (Indicator: " bind "; File: "draftview.exe") Found reference to API "lock socket failed: %s" (Indicator: " socket "; File: "draftview.exe") Found reference to API "[%s] parse socket (%d)" (Indicator: " socket "; File: "draftview.exe") Found reference to API "[%s] connect connection (%d)" (Indicator: " connect "; File: "draftview.exe") Found reference to API "Cannot bind missing request" (Indicator: " bind "; File: "draftview.exe") file/memory contains long string with (Indicator: " connect "; File: "draftview.exe") Found reference to API "Software\Microsoft\Windows\CurrentVersion\Internet SettingsProxyEnableProxyServerProxyOverride*.invalid URL, scheme is not httpinvalid URL, host is missinginvalid URL, scheme is missingtcp open errortcp set_nonblocking errortcp bind local error" (Indicator: " bind "; File: "draftview.exe")35:T10542,Heuristic match: "<>.th" Heuristic match: "c:\r\src\g\e.rs" Heuristic match: "src\software.rs" Heuristic match: "/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\alloc\src\fmt.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\anyhow-1.0.102\src\error.rs" Heuristic match: "caused by:deps\index.crates.io-1949cf8c6b5b557f\anyhow-1.0.102\src\fmt.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\ash-0.38.0+1.3.281\src\tables.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\ash-0.38.0+1.3.281\src\extensions_generated.rs" Pattern match: "https://registry.khronos.org/vulkan/specs/1.3-extensions/html/vkspec.html#devsandqueues-lost-device" Heuristic match: "or_incompatible_drivererror_too_many_objectserror_format_not_supportederror_fragmented_poolerror_unknownerror_surface_lost_khrerror_native_window_in_use_khrsuboptimal_khrerror_out_of_date_khrerror_incompatible_display_khrerror_validation_failed_exterror_in" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\base64-0.22.1\src\engine\general_purpose\decode_suffix.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\base64-0.22.1\src\engine\general_purpose\decode.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\bytes-1.11.1\src\lib.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\codespan-reporting-0.11.1\src\term\renderer.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\unicode-width-0.1.14\src\tables.rs" Heuristic match: "/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\fmt\num.rs" Heuristic match: "/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\unicode\unicode_data.rs" Heuristic match: "!$'+.158;/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\num\imp\dec2flt\parse.rs" Heuristic match: "(/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\fmt\builders.rs" Heuristic match: "/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\net\parser.rs" Heuristic match: "/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\num\imp\dec2flt\decimal_seq.rs" Heuristic match: "/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\num\imp\diy_float.rs" Heuristic match: "/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\num\imp\bignum.rs" Heuristic match: "assertion failed: digits < 40/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\wtf8.rs" Heuristic match: "/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\slice\memchr.rs" Heuristic match: "/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\unicode\printable.rs" Heuristic match: "wuser-provided comparison function does not correctly implement a total order/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\slice\sort\shared\smallsort.rs" Heuristic match: "assertion failed: d.mant > 0/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\num\imp\flt2dec\strategy\grisu.rs" Heuristic match: "/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\num\imp\flt2dec\strategy\dragon.rs" Heuristic match: "/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\net\ip_addr.rs" Heuristic match: "/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\net\socket_addr.rs" Heuristic match: "/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\net\display_buffer.rs" Heuristic match: "9qdeps\index.crates.io-1949cf8c6b5b557f\crc32fast-1.5.0\src\baseline.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\crc32fast-1.5.0\src\specialized\pclmulqdq.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\crossbeam-epoch-0.9.18\src\sync\once_lock.rs" Heuristic match: "unaligned pointerdeps\index.crates.io-1949cf8c6b5b557f\crossbeam-epoch-0.9.18\src\atomic.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\crossbeam-epoch-0.9.18\src\sync\list.rs" Heuristic match: "valid numbervalid integervalid real numbervalid hex digithex digit after '#' in namesecond hex digit after '#' in namearray for rectanglenumber in rectangle arraycatalog dictionary/pages reference in catalogpage tree node dictionary/kids array in /pages no" Heuristic match: "window size must be non-zero.\parsers\parser2\src\font.rs" Heuristic match: ">> or other tokenvalid token.\parsers\parser2\src\lexer.rs" Heuristic match: "4-element rectangle arraymediaboxpagecontentskids.\parsers\parser2\src\xref.rs" Heuristic match: "flatedecodeflasciihexdecodeahxascii85decodea85.\parsers\parser2\src\stream.rs" Heuristic match: "hex digit.\parsers\parser2\src\objects.rs" Heuristic match: "integer generation numberinteger object numberid.\parsers\parser2\src\operators.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\ecolor-0.29.1\src\lib.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\png-0.18.1\src\encoder.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\eframe-0.29.1\src\native\run.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\glutin-0.32.3\src\context.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\eframe-0.29.1\src\native\glow_integration.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\eframe-0.29.1\src\native\wgpu_integration.rs" Heuristic match: "attempted to set a new event loop while one is already setdeps\index.crates.io-1949cf8c6b5b557f\eframe-0.29.1\src\native\event_loop_context.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\image-0.25.10\src\io\encoder.rs" Heuristic match: "eframe_screenshot_toeframe_screenshot_to found without compiling with the '__screenshot' featuredeps\index.crates.io-1949cf8c6b5b557f\eframe-0.29.1\src\lib.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\fdeflate-0.3.7\src\compress.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\eframe-0.29.1\src\stopwatch.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\eframe-0.29.1\src\native\epi_integration.rs" Heuristic match: "raw_coderaw_os_messageinitializationfailedbadaccessbadattributebadcontextbadcontextstatebadconfigbadcurrentsurfacebaddisplaybadsurfacebadpbufferbadpixmapbadmatchbadparameterbadnativepixmapbadnativewindowcontextlostmiscdeps\index.crates.io-1949cf8c6b5b557f\" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\egui-0.29.1\src\util\id_type_map.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\egui-0.29.1\src\widgets\image.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\egui-0.29.1\src\widgets\label.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\egui-0.29.1\src\widgets\text_edit\builder.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\egui-0.29.1\src\grid.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\egui-0.29.1\src\containers\area.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\egui-0.29.1\src\containers\scroll_area.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\egui-0.29.1\src\text_selection\cursor_range.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\egui-0.29.1\src\context.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\egui-0.29.1\src\style.rs" Heuristic match: "debugdeps\index.crates.io-1949cf8c6b5b557f\egui-0.29.1\src\response.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\egui-0.29.1\src\input_state\touch_state.rs" Heuristic match: "`;downupcolonpipequestionmarkopenbracketclosebracketbacktickplusequals56789aehimopvgraveeopdeps\index.crates.io-1949cf8c6b5b557f\egui-0.29.1\src\widgets\spinner.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\egui-0.29.1\src\layers.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\egui-0.29.1\src\util\undoer.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\egui-0.29.1\src\widget_rect.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\egui-0.29.1\src\hit_test.rs" Heuristic match: "assertion failed: char_range.start <= char_range.enddeps\index.crates.io-1949cf8c6b5b557f\egui-0.29.1\src\text_selection\text_cursor_state.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\egui-0.29.1\src\text_selection\visuals.rs" Pattern match: "https://docs.rs/egui/latest/egui/load/index.htmlimage" Heuristic match: "egui::load::texture_loader::defaulttextureloaderdeps\index.crates.io-1949cf8c6b5b557f\egui-0.29.1\src\widgets\text_edit\text_buffer.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\egui_glow-0.29.1\src\painter.rs" Heuristic match: "#version 120#version 140#version 100#version 300 esdeps\index.crates.io-1949cf8c6b5b557f\egui_glow-0.29.1\src\shader_version.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\egui_glow-0.29.1\src\vao.rs" Pattern match: "https://www.shadertoy.com/view/llvgzg//" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\egui-wgpu-0.29.1\src\renderer.rs" Heuristic match: "egui wgpu devicedeps\index.crates.io-1949cf8c6b5b557f\egui-wgpu-0.29.1\src\lib.rs" Heuristic match: "egui_screen_capture_textureegui_screen_capture_bufferdeps\index.crates.io-1949cf8c6b5b557f\egui-wgpu-0.29.1\src\winit.rs" Pattern match: "https://github.com/gfx-rs/wgpu/issues/2072" Heuristic match: "backquotebackslashcommadigit0digit1digit2digit3digit4digit5digit6digit7digit8digit9minusperiodquotesemicolonslashbackspaceenterspacetabdeletehomeinsertpagedownpageuparrowdownarrowleftarrowrightarrowupnumpad0numpad1numpad2numpad3numpad4numpad5numpad6numpad7" Heuristic match: "formatting argument out of rangedeps\index.crates.io-1949cf8c6b5b557f\encoding_rs-0.8.35\src\handles.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\encoding_rs-0.8.35\src\iso_2022_jp.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\encoding_rs-0.8.35\src\utf_8.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\encoding_rs-0.8.35\src\gb18030.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\encoding_rs-0.8.35\src\data.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\epaint-0.29.1\src\tessellator.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\epaint-0.29.1\src\shape.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\epaint-0.29.1\src\image.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\epaint-0.29.1\src\text\font.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\epaint-0.29.1\src\text\fonts.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\epaint-0.29.1\src\mesh.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\epaint-0.29.1\src\text\text_layout.rs" Heuristic match: "tiny texture atlasdeps\index.crates.io-1949cf8c6b5b557f\epaint-0.29.1\src\texture_atlas.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\epaint-0.29.1\src\text\text_layout_types.rs" Pattern match: "github.com/source-foundryhttps://github.com/source-foundry/hackthe" Heuristic match: "failed to format error into utf-8/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\iter\adapters\step_by.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\fdeflate-0.3.7\src\decompress.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\fdeflate-0.3.7\src\huffman.rs" Heuristic match: "send failed because receiver is gonesend failed because channel is fulldeps\index.crates.io-1949cf8c6b5b557f\futures-core-0.3.32\src\task\__internal\atomic_waker.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\glow-0.13.1\src\version.rs" Heuristic match: "instancedbasevertexbaseinstanceglenableiglcullfacegldisableiglendqueryglblendfuncgldepthfuncgldepthmaskglfencesyncglfrontfaceglgetsyncivgluniform1fgluniform4fdeps\index.crates.io-1949cf8c6b5b557f\glow-0.13.1\src\gl46.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\glow-0.14.2\src\native.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\glow-0.14.2\src\version.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\glow-0.14.2\src\gl46.rs" Heuristic match: "egl_img_context_priorityfailed to create egldisplay without a reasondeps\index.crates.io-1949cf8c6b5b557f\glutin-0.32.3\src\api\egl\display.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\glutin-0.32.3\src\display.rs" Heuristic match: "the requested context api isn't supported.deps\index.crates.io-1949cf8c6b5b557f\glutin-0.32.3\src\api\egl\context.rs" Heuristic match: "egl_ext_platform_x11egl_mesa_platform_xcbegl_ext_platform_xcbegl_ext_platform_waylandegl_mesa_platform_gbmegl_angle_platform_angledeps\index.crates.io-1949cf8c6b5b557f\glutin-0.32.3\src\api\egl\surface.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\glutin-0.32.3\src\api\wgl\config.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\glutin-0.32.3\src\api\wgl\context.rs" Heuristic match: "extension to create es context with wgl is not presentwgl_arb_create_context_robustness is not supportedwgl_arb_create_context_no_error not supportedflush control behavior wgl_arb_context_flush_controlwgl_arb_multisamplewgl_arb_pixel_format_floatwgl_ext_co" Heuristic match: "provided native display is not supporteddeps\index.crates.io-1949cf8c6b5b557f\glutin-0.32.3\src\api\wgl\surface.rs" Heuristic match: "egl function was not loaded.\apps\ironbark\target\release\build\glutin_egl_sys-3d0cdaad2bebb167\out/egl_bindings.rs" Heuristic match: "wgl function was not loaded.\apps\ironbark\target\release\build\glutin_wgl_sys-66580df4b77ea83e\out/wgl_extra_bindings.rs" Heuristic match: "helpcopydeps\index.crates.io-1949cf8c6b5b557f\gpu-alloc-0.6.0\src\usage.rs" Heuristic match: "chunk id must be 1.dedicatedblockallocator size must match allocation size.internal error: entered unreachable yode: invalid once state/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\sys\sync\once\futex.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\h2-0.4.13\src\frame\head.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\h2-0.4.13\src\hpack\decoder.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\h2-0.4.13\src\hpack\encoder.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\h2-0.4.13\src\frame\headers.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\bytes-1.11.1\src\buf\buf_mut.rs" Heuristic match: "not a result of an errorunspecific protocol error detectedunexpected internal error encounteredflow-control protocol violatedsettings ack not received in timely mannerreceived frame when stream half-closedframe with invalid sizerefused stream before proces" Heuristic match: "assertion failed: default_max_frame_size <= val && val <= max_max_frame_sizedeps\index.crates.io-1949cf8c6b5b557f\h2-0.4.13\src\frame\settings.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\h2-0.4.13\src\frame\stream_id.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\h2-0.4.13\src\hpack\table.rs" Heuristic match: "assertion failed: !id.is_zero()deps\index.crates.io-1949cf8c6b5b557f\h2-0.4.13\src\proto\peer.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\bytes-1.11.1\src\buf\uninit_slice.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\h2-0.4.13\src\proto\streams\flow_control.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\h2-0.4.13\src\proto\streams\state.rs" Heuristic match: "assertion failed: stream.is_counteddeps\index.crates.io-1949cf8c6b5b557f\h2-0.4.13\src\proto\streams\counts.rs" Heuristic match: "invalid initial receive windowdeps\index.crates.io-1949cf8c6b5b557f\h2-0.4.13\src\proto\streams\stream.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\h2-0.4.13\src\hpack\header.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\bytes-1.11.1\src\buf\limit.rs" Heuristic match: "/rust/deps\hashbrown-0.17.0\src\raw.rs" Heuristic match: "hash table capacity overflowdeps\index.crates.io-1949cf8c6b5b557f\hashbrown-0.17.0\src\raw.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\hassle-rs-0.11.0\src\wrapper.rs" Heuristic match: "queryinterface returned non-standard errordeps\index.crates.io-1949cf8c6b5b557f\com-0.6.0\src\interfaces\iunknown.rs" Heuristic match: "dxil.dlldeps\index.crates.io-1949cf8c6b5b557f\hassle-rs-0.11.0\src\utils.rs" Heuristic match: "containsnuldeps\index.crates.io-1949cf8c6b5b557f\hexf-parse-0.2.1\src\lib.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\http-1.4.0\src\uri\authority.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\http-1.4.0\src\method.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\http-1.4.0\src\uri\path.rs" Pattern match: "http://https://invalid" Heuristic match: "http::errorhttp/0.9http/2.0http/3.0deps\index.crates.io-1949cf8c6b5b557f\http-1.4.0\src\version.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\httparse-1.10.1\src\lib.rs" Heuristic match: "invalid header nameinvalid header valueinvalid new lineinvalid response statusinvalid tokentoo many headersinvalid http versiondeps\index.crates.io-1949cf8c6b5b557f\httparse-1.10.1\src\simd\swar.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\hyper-1.9.0\src\error.rs" Heuristic match: "just sent okdeps\index.crates.io-1949cf8c6b5b557f\hyper-1.9.0\src\body\incoming.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\hyper-1.9.0\src\proto\h2\ping.rs" Heuristic match: "you must supply a timer.deps\index.crates.io-1949cf8c6b5b557f\hyper-1.9.0\src\common\time.rs" Heuristic match: "chunkedinternal error: entered unreachable yode: bodylength::unknown would set chunkeddeps\index.crates.io-1949cf8c6b5b557f\hyper-1.9.0\src\proto\h1\role.rs" Heuristic match: "original header value plus ascii is validdeps\index.crates.io-1949cf8c6b5b557f\hyper-1.9.0\src\headers.rs" Heuristic match: "partial headerdeps\index.crates.io-1949cf8c6b5b557f\hyper-1.9.0\src\proto\h2\upgrade.rs" Heuristic match: "https required but uri was not httpsdeps\index.crates.io-1949cf8c6b5b557f\windows-registry-0.6.1\src\key.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\base64-0.22.1\src\encode.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\base64-0.22.1\src\write\encoder.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\http-1.4.0\src\uri\scheme.rs" Heuristic match: "socks4socks4asocks5socks5hdeps\index.crates.io-1949cf8c6b5b557f\hyper-util-0.1.20\src\client\proxy\matcher.rs" Heuristic match: "[internal exception] blocking task ran twice.deps\index.crates.io-1949cf8c6b5b557f\tokio-1.52.1\src\runtime\blocking\task.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\idna-1.1.0\src\uts46.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\idna-1.1.0\src\punycode.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\icu_normalizer-2.2.0\src\lib.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\zune-jpeg-0.5.15\src\mcu.rs" Heuristic match: "would panic on slice iterationdeps\index.crates.io-1949cf8c6b5b557f\zune-jpeg-0.5.15\src\bitstream.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\image-0.25.10\src\metadata\cicp.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\image-0.25.10\src\images\buffer.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\image-0.25.10\src\imageops\sample.rs" Pattern match: "http://ns.adobe.com/xap/1.0/" Pattern match: "http://ns.adobe.com/xmp/extension/" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\zune-jpeg-0.5.15\src\headers.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\zune-jpeg-0.5.15\src\mcu_prog.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\image-0.25.10\src\color.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\zune-jpeg-0.5.15\src\decoder.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\png-0.18.1\src\decoder\read_decoder.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\image-0.25.10\src\io\image_reader_type.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\image-0.25.10\src\codecs\png.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\image-0.25.10\src\codecs\jpeg\decoder.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\zune-core-0.5.1\src\bytestream\reader\no_std_readers.rs" Heuristic match: "avifjpgjpegjfifpngapnggifwebptiftifftgaddsbmpicohdrexrpbmpamppmpgmpnmffqoideps\index.crates.io-1949cf8c6b5b557f\zune-core-0.5.1\src\bytestream\reader\std_readers.rs" Heuristic match: "ideps\index.crates.io-1949cf8c6b5b557f\ipnet-2.12.0\src\parser.rs" Heuristic match: "prefixlenerrorat least two bytes should follow the `%` in a valid iri referencedeps\index.crates.io-1949cf8c6b5b557f\iri-string-0.7.12\src\parser\trusted.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\iri-string-0.7.12\src\parser\str.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\iri-string-0.7.12\src\components.rs" Heuristic match: "non-relative iri must have a schemedeps\index.crates.io-1949cf8c6b5b557f\iri-string-0.7.12\src\normalize.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\iri-string-0.7.12\src\normalize\pct_case.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\ab_glyph_rasterizer-0.1.10\src\raster.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\ahash-0.8.12\src\convert.rs" Heuristic match: "c:\r\src\g\register.rs" Heuristic match: "let's goread through the guide before proceedingexitclosesrc\app_core.rs" Heuristic match: "differencessrc\parser\text_layout.rs" Heuristic match: "src\parser\render.rs" Heuristic match: "src\ui\thumbnails.rs" Heuristic match: "failed to find current viewport in egui rawinput. this is the fault of the egui backenddeps\index.crates.io-1949cf8c6b5b557f\egui-0.29.1\src\data\input.rs" Heuristic match: "src\ui\search.rs" Pattern match: "helvetica.ttc/system/library/fonts/sfnstext.ttfc:\windows\fonts\arial.ttfc:\windows\fonts\segoeui.ttf/usr/share/fonts/truetype/dejavu/dejavusans.ttfresources" Heuristic match: ",= lendeps\index.crates.io-1949cf8c6b5b557f\h2-0.4.13\src\frame\data.rs" Heuristic match: "assertion failed: !self.context.is_null()deps\index.crates.io-1949cf8c6b5b557f\tokio-native-tls-0.3.1\src\lib.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\hyper-1.9.0\src\client\conn\http2.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\hyper-1.9.0\src\proto\h1\io.rs" Heuristic match: "dns errordeps\index.crates.io-1949cf8c6b5b557f\hyper-util-0.1.20\src\client\legacy\connect\http.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\schannel-0.1.29\src\tls_stream.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.28\src\connect.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.28\src\async_impl\request.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\h2-0.4.13\src\proto\streams\buffer.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\hyper-util-0.1.20\src\client\legacy\client.rs" Heuristic match: "base64 is always valid headervaluedeps\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.28\src\util.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.28\src\async_impl\body.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\tokio-util-0.7.18\src\util\poll_buf.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\tokio-1.52.1\src\sync\mpsc\list.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\futures-util-0.3.32\src\future\select.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\hyper-1.9.0\src\client\conn\http1.rs" Heuristic match: "pri * http/2.0smdeps\index.crates.io-1949cf8c6b5b557f\h2-0.4.13\src\client.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\hyper-tls-0.6.0\src\client.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\hyper-util-0.1.20\src\rt\io.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.28\src\blocking\client.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\hyper-1.9.0\src\proto\h2\client.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\hyper-util-0.1.20\src\client\legacy\connect\dns.rs" Heuristic match: "proxy-authorization: deps\index.crates.io-1949cf8c6b5b557f\hyper-util-0.1.20\src\client\legacy\connect\proxy\tunnel.rs" Heuristic match: "envelope not droppeddeps\index.crates.io-1949cf8c6b5b557f\hyper-1.9.0\src\client\dispatch.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.28\src\async_impl\response.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\tokio-1.52.1\src\net\tcp\socket.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\hyper-1.9.0\src\proto\h1\conn.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\tokio-1.52.1\src\sync\mpsc\unbounded.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\hyper-util-0.1.20\src\client\legacy\pool.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.28\src\blocking\body.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.28\src\dns\gai.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.28\src\async_impl\client.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\mime-0.3.17\src\lib.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\encoding_rs-0.8.35\src\lib.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\hyper-1.9.0\src\rt\io.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\http-1.4.0\src\header\value.rs" Heuristic match: "assertion failed: default_max_frame_size as usize <= val && val <= max_max_frame_size as usizedeps\index.crates.io-1949cf8c6b5b557f\h2-0.4.13\src\codec\framed_read.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\hyper-util-0.1.20\src\common\lazy.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\futures-util-0.3.32\src\future\future\map.rs" Heuristic match: "assertion failed: slot.is_none()deps\index.crates.io-1949cf8c6b5b557f\futures-channel-0.3.32\src\oneshot.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\tokio-1.52.1\src\util\sharded_list.rs" Heuristic match: "mutex poisoneddeps\index.crates.io-1949cf8c6b5b557f\h2-0.4.13\src\proto\connection.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.28\src\proxy.rs" Heuristic match: "assertion failed: (*tail).value.is_none()deps\index.crates.io-1949cf8c6b5b557f\futures-channel-0.3.32\src\mpsc\queue.rs" Heuristic match: "*/*assertion failed: val <= frame::max_max_frame_size as usizedeps\index.crates.io-1949cf8c6b5b557f\h2-0.4.13\src\codec\framed_write.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\slab-0.4.12\src\lib.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\http-body-util-0.1.3\src\combinators\collect.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\hyper-util-0.1.20\src\rt\tokio.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\tokio-1.52.1\src\io\util\write_all.rs" Heuristic match: "polled feed after completiondeps\index.crates.io-1949cf8c6b5b557f\futures-util-0.3.32\src\sink\feed.rs" Heuristic match: "tryflatten polled after completiondeps\index.crates.io-1949cf8c6b5b557f\futures-util-0.3.32\src\future\try_future\try_flatten.rs" Heuristic match: "ready polled after completiondeps\index.crates.io-1949cf8c6b5b557f\futures-util-0.3.32\src\future\ready.rs" Heuristic match: "already calleddeps\index.crates.io-1949cf8c6b5b557f\tower-0.5.3\src\util\oneshot.rs" Heuristic match: "fulldisconnected`len` greater than remainingdeps\index.crates.io-1949cf8c6b5b557f\http-body-util-0.1.3\src\util.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\hyper-1.9.0\src\common\buf.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\hyper-util-0.1.20\src\service\oneshot.rs" Heuristic match: "retrying requires cloned requestdeps\index.crates.io-1949cf8c6b5b557f\tower-0.5.3\src\retry\future.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\bytes-1.11.1\src\buf\take.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\bytes-1.11.1\src\buf\chain.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\hyper-1.9.0\src\common\io\compat.rs" Heuristic match: "`deps\index.crates.io-1949cf8c6b5b557f\rfd-0.15.4\src\backend\win_cid\file_dialog\com.rs" Heuristic match: "gzip header field too longcorrupt deflate streamdeps\index.crates.io-1949cf8c6b5b557f\flate2-1.1.9\src\zio.rs" Heuristic match: "assertion failed: n <= init_unfilled/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\io\borrowed_buf.rs" Heuristic match: "c:\r\src\c\i\profile.rs" Heuristic match: "comsuccessecdurst1c:\r\src\f\commands.rs" Heuristic match: "st2trunc1trunc2errserialize_value called before serialize_keydeps\index.crates.io-1949cf8c6b5b557f\serde_json-1.0.149\src\value\ser.rs" Heuristic match: "--uidc:\r\src\f\uid.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\flate2-1.1.9\src\gz\write.rs" Heuristic match: "c:\r\src\f\http.rs" Heuristic match: "uldbrtc:\r\src\f\browser.rs" Heuristic match: "invalid downloadcommanddownloadlocaluser datac:\r\src\c\i\e.rs" Heuristic match: "defaultprofile pnameoffsetemoffseteaoffsetlsoffsettnssapsacgzpfroamingc:\r\src\d\i\e.rs" Heuristic match: "c:\r\src\d\i\profile.rs" Heuristic match: "ejrejcpipjsjujejviviknvdeps\index.crates.io-1949cf8c6b5b557f\flate2-1.1.9\src\crc.rs" Heuristic match: "contextdeps\index.crates.io-1949cf8c6b5b557f\flate2-1.1.9\src\bufreader.rs" Heuristic match: "invalidbyteinvalidlengthinvalidlastsymbolinvalidpaddingdeps\index.crates.io-1949cf8c6b5b557f\flate2-1.1.9\src\gz\bufread.rs" Heuristic match: "/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\io\impls.rs" Heuristic match: "{invalid syntax}{recursion limit xeached}`fmt::error`s should be impossible without a `fmt::formatter`/rust/deps\rustc-demangle-0.1.27\src\v0.rs" Heuristic match: " fn( -> punycode{.llvm./rust/deps\rustc-demangle-0.1.27\src\lib.rs" Heuristic match: "/rust/deps\rustc-demangle-0.1.27\src\legacy.rs" Heuristic match: "sizelimitexhaustedparseinterror/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\ops\function.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\schannel-0.1.29\src\alpn_list.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\itoa-1.0.18\src\lib.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\serde_json-1.0.149\src\read.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\serde_json-1.0.149\src\ser.rs" Heuristic match: "ullruealse{,: nulldeps\index.crates.io-1949cf8c6b5b557f\serde_json-1.0.149\src\value\index.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\smbios-lib-0.9.4\src\structs\types\system_information.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\smbios-lib-0.9.4\src\core\undefined_struct.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\smbios-lib-0.9.4\src\windows\win_struct.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\socket2-0.6.3\src\sys\windows.rs" Heuristic match: "softbuffer_0.4.8_dc_allocatordeps\index.crates.io-1949cf8c6b5b557f\softbuffer-0.4.8\src\backends\win32.rs" Heuristic match: "/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\sys\process\windows.rs" Heuristic match: "/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\io\stdio.rs" Heuristic match: "/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\sys\args\windows.rs" Heuristic match: "/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\sys\process\windows\child_pipe.rs" Heuristic match: "/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\env.rs" Heuristic match: "/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\thread\id.rs" Heuristic match: "too many running threads in thread scope/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\thread\scoped.rs" Heuristic match: "/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\sys\stdio\windows.rs" Heuristic match: "/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\sys\thread\windows.rs" Heuristic match: "too many active read locks on rwlock/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\sys\sync\rwlock\futex.rs" Heuristic match: "/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\ffi\os_str.rs" Heuristic match: "/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\path.rs" Heuristic match: "lock count overflow in reentrant mutex/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\sync\reentrant_lock.rs" Heuristic match: "advancing ioslice beyond its length/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\sys\io\io_slice\windows.rs" Heuristic match: "/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\rt.rs" Heuristic match: "thread caused non-unwinding panic. aborting./qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\..\..\backtrace\src\dbghelp.rs" Heuristic match: "lazylock instance has previously been poisoned/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\sync\lazy_lock.rs" Heuristic match: "use of std::thread::current() is not possible after the thread's local data has been destroyed/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\thread\current.rs" Heuristic match: "/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\sys\env\windows.rs" Pattern match: "cmd.exe/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\sys\thread_local\destructors\list.rs" Heuristic match: "/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\sys\io\error\windows.rs" Heuristic match: "/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\sys\pal\windows\winsock.rs" Heuristic match: "thread/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\thread\functions.rs" Heuristic match: "/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\sys\pal\windows\time.rs" Heuristic match: "backtrace /qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\backtrace.rs" Heuristic match: "wouldblockfatal runtime error: an irrecoverable error occurred while synchronizing threads, abortingthread name may not contain interior null bytes/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\thread\thread.rs" Heuristic match: "/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\time.rs" Heuristic match: "=deps\index.crates.io-1949cf8c6b5b557f\sysinfo-0.32.1\src\windows\process.rs" Heuristic match: "assertion failed: injected && !worker_thread.is_null()deps\index.crates.io-1949cf8c6b5b557f\rayon-core-1.13.0\src\registry.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\sysinfo-0.32.1\src\windows\system.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\sysinfo-0.32.1\src\windows\sid.rs" Heuristic match: "assertion failed: vec.capacity() - start >= lendeps\index.crates.io-1949cf8c6b5b557f\rayon-core-1.13.0\src\job.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\sysinfo-0.32.1\src\windows\cpu.rs" Pattern match: "taskkill.exe/pid/f" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\rayon-1.12.0\src\vec.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\rayon-core-1.13.0\src\latch.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.11.4\src\alpha_runs.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.11.4\src\edge_builder.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.11.4\src\edge_clipper.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.11.4\src\geom.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.11.4\src\pixmap.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.11.4\src\path64\cubic64.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.11.4\src\pipeline\lowp.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.11.4\src\pipeline\highp.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.11.4\src\pipeline\blitter.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.11.4\src\edge.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.11.4\src\scan\path_aa.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.11.4\src\shaders\gradient.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.11.4\src\line_clipper.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.11.4\src\path_geometry.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.11.4\src\fixed_point.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.11.4\src\scan\hairline_aa.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.11.4\src\scan\path.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.11.4\src\scan\hairline.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.11.4\src\path64\line_cubic_intersections.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.11.4\src\path64\quad64.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\tiny-skia-0.11.4\src\blitter.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\bytemuck-1.25.0\src\internal.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\tiny-skia-path-0.11.4\src\path_builder.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\tiny-skia-path-0.11.4\src\path.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\tiny-skia-path-0.11.4\src\rect.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\tiny-skia-path-0.11.4\src\size.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\tiny-skia-path-0.11.4\src\path_geometry.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\tiny-skia-path-0.11.4\src\stroker.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\tokio-1.52.1\src\runtime\io\registration.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\tokio-1.52.1\src\runtime\io\driver.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\tokio-1.52.1\src\runtime\park.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\tokio-1.52.1\src\runtime\task\core.rs" Heuristic match: "there is no such thing as a release load/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\sync\atomic.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\tokio-1.52.1\src\runtime\context\current.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\tokio-1.52.1\src\sync\oneshot.rs" Heuristic match: "assertion failed: curr.is_join_interested()deps\index.crates.io-1949cf8c6b5b557f\tokio-1.52.1\src\runtime\task\state.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\tokio-1.52.1\src\io\poll_evented.rs" Heuristic match: "assertion failed: c.runtime.get().is_entered()deps\index.crates.io-1949cf8c6b5b557f\tokio-1.52.1\src\runtime\context\runtime.rs" Heuristic match: "filled must not become larger than initializeddeps\index.crates.io-1949cf8c6b5b557f\tokio-1.52.1\src\io\read_buf.rs" Heuristic match: "filled overflowdeps\index.crates.io-1949cf8c6b5b557f\tokio-1.52.1\src\time\sleep.rs" Heuristic match: "assertion failed: value <= self.max_value()deps\index.crates.io-1949cf8c6b5b557f\tokio-1.52.1\src\util\bit.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\tokio-1.52.1\src\util\wake_list.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\tokio-1.52.1\src\runtime\handle.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\tokio-1.52.1\src\net\tcp\stream.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\tokio-1.52.1\src\net\windows\named_pipe.rs" Heuristic match: "rng seed generator is internally corruptdeps\index.crates.io-1949cf8c6b5b557f\tokio-1.52.1\src\util\rand\rt.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\tokio-1.52.1\src\runtime\task\list.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\tokio-1.52.1\src\runtime\metrics\worker.rs" Heuristic match: "cannot drop a runtime in a context where blocking is not allowed. this happens when a runtime is dropped from within an asynchronous context.deps\index.crates.io-1949cf8c6b5b557f\tokio-1.52.1\src\runtime\blocking\shutdown.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\tokio-1.52.1\src\runtime\scheduler\defer.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\tokio-1.52.1\src\runtime\time\wheel\level.rs" Heuristic match: "mark_pending called when the timer entry is in an invalid statedeps\index.crates.io-1949cf8c6b5b557f\tokio-1.52.1\src\runtime\time\entry.rs" Heuristic match: "threads should not terminate unexpectedly/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\thread\lifecycle.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\tokio-1.52.1\src\util\linked_list.rs" Heuristic match: "assertion failed: shared.shutdown_tx.is_some()deps\index.crates.io-1949cf8c6b5b557f\tokio-1.52.1\src\runtime\blocking\pool.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\tokio-1.52.1\src\sync\notify.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\tokio-1.52.1\src\runtime\task\harness.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\tokio-1.52.1\src\runtime\blocking\schedule.rs" Heuristic match: "provided length would overflow after adjustmentdeps\index.crates.io-1949cf8c6b5b557f\bytes-1.11.1\src\buf\buf_impl.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\bytes-1.11.1\src\bytes.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\bytes-1.11.1\src\bytes_mut.rs" Heuristic match: "/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\time.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\tower-0.5.3\src\retry\budget\tps_budget.rs" Heuristic match: "request timed outdeps\index.crates.io-1949cf8c6b5b557f\iri-string-0.7.12\src\normalize\path.rs" Heuristic match: ".//.//.//internal error: entered unreachable yode: this case should be handled by the callerdeps\index.crates.io-1949cf8c6b5b557f\iri-string-0.7.12\src\parser\validate\path.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\iri-string-0.7.12\src\parser\char.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\ttf-parser-0.25.1\src\tables\cff\argstack.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\ttf-parser-0.25.1\src\tables\cff\cff2.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\ttf-parser-0.25.1\src\tables\gvar.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\ttf-parser-0.25.1\src\tables\cff\dict.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\ttf-parser-0.25.1\src\lib.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\unicode-segmentation-1.13.2\src\tables.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\url-2.5.8\src\parser.rs" Heuristic match: "assertion failed: self.is_char_boundary(idx)assertion failed: self.is_char_boundary(new_len)assertion failed: self.is_char_boundary(at)deps\index.crates.io-1949cf8c6b5b557f\url-2.5.8\src\host.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\utf8_iter-1.0.4\src\lib.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\uuid-1.23.1\src\rng.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\uuid-1.23.1\src\fmt.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\uuid-1.23.1\src\parser.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\want-0.3.1\src\lib.rs" Heuristic match: "file://deps\index.crates.io-1949cf8c6b5b557f\url-2.5.8\src\lib.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\webbrowser-1.2.1\src\common.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\webbrowser-1.2.1\src\windows.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\bit-vec-0.7.0\src\lib.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\wgpu-core-22.1.0\src\pool.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\wgpu-core-22.1.0\src\command\clear.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\wgpu-22.1.0\src\backend\wgpu_core.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\wgpu-core-22.1.0\src\command\query.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\wgpu-core-22.1.0\src\command\compute.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\wgpu-22.1.0\src\lib.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\wgpu-core-22.1.0\src\track\texture.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\wgpu-core-22.1.0\src\command\render.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\wgpu-core-22.1.0\src\command\memory_init.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\wgpu-22.1.0\src\context.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\wgpu-core-22.1.0\src\lib.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\wgpu-core-22.1.0\src\track\range.rs" Heuristic match: "limitsfeaturesdownleveldeps\index.crates.io-1949cf8c6b5b557f\wgpu-22.1.0\src\util\device.rs" Heuristic match: "allocationnativetexturerenderbundleerrorarcrenderpassdepthstencilattachmentstencilrendervalidationmap_flagsframebufferattachmentraw_image_flagsview_usageview_formatraw_view_formatsrenderbufferdefaultrenderbufferaccesserrorunalignedsizeusagemismatchmaxbuffe" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\wgpu-core-22.1.0\src\device\global.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\wgpu-core-22.1.0\src\pipeline_cache.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\wgpu-core-22.1.0\src\instance.rs" Heuristic match: "assertion failed: indices.capacity() - indices.len() >= entries.len()deps\index.crates.io-1949cf8c6b5b557f\indexmap-2.14.0\src\inner.rs" Heuristic match: "/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\slice\sort\unstable\quicksort.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\wgpu-core-22.1.0\src\track\metadata.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\wgpu-core-22.1.0\src\validation.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\wgpu-core-22.1.0\src\command\bundle.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\wgpu-core-22.1.0\src\id.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\wgpu-core-22.1.0\src\global.rs" Heuristic match: "pipelinelayoutbindgrouplayoutbindgroupcommandbufferadaptershadermodulepipelinecacherenderpipelinecomputepipelinetextureviewstagingbuffertexturequerysetqueuedevicerenderbundlesurfacedeps\index.crates.io-1949cf8c6b5b557f\wgpu-core-22.1.0\src\device\life.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\wgpu-core-22.1.0\src\binding_model.rs" Heuristic match: "assertion failed: self.sorteddeps\index.crates.io-1949cf8c6b5b557f\wgpu-core-22.1.0\src\device\bgl.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\wgpu-core-22.1.0\src\device\resource.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\wgpu-core-22.1.0\src\resource.rs" Heuristic match: "failed to insert into arena. handle overflowsdeps\index.crates.io-1949cf8c6b5b557f\naga-22.1.0\src\arena\handle.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\wgpu-core-22.1.0\src\hub.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\wgpu-core-22.1.0\src\storage.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\indexmap-2.14.0\src\inner\entry.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\wgpu-core-22.1.0\src\init_tracker\texture.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\wgpu-core-22.1.0\src\command\bind.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\wgpu-core-22.1.0\src\command\transfer.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\wgpu-core-22.1.0\src\present.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\wgpu-core-22.1.0\src\pipeline.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\wgpu-core-22.1.0\src\error.rs" Heuristic match: "..deps\index.crates.io-1949cf8c6b5b557f\wgpu-core-22.1.0\src\device\queue.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\smallvec-1.15.1\src\lib.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\range-alloc-0.1.5\src\lib.rs" Heuristic match: "d3d12createdevice`device_address` cannot be requested when `deviceproperties::buffer_device_address` is falsedeps\index.crates.io-1949cf8c6b5b557f\gpu-alloc-0.6.0\src\allocator.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\wgpu-hal-22.0.0\src\vulkan\device.rs" Heuristic match: "#extension gl_arb_compute_shader : requiredeps\index.crates.io-1949cf8c6b5b557f\naga-22.1.0\src\back\glsl\features.rs" Heuristic match: "ion gl_khr_shader_subgroup_arithmetic : require#extension gl_khr_shader_subgroup_ballot : require#extension gl_khr_shader_subgroup_shuffle : require#extension gl_khr_shader_subgroup_shuffle_relative : require, deps\index.crates.io-1949cf8c6b5b557f\naga-22." Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\ash-0.38.0+1.3.281\src\vk\definitions.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\gpu-alloc-0.6.0\src\block.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\indexmap-2.14.0\src\map.rs" Heuristic match: "invalid pool iddeps\index.crates.io-1949cf8c6b5b557f\gpu-descriptor-0.3.2\src\allocator.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\once_cell-1.21.4\src\lib.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\gpu-alloc-0.6.0\src\buddy.rs" Heuristic match: "any value not greater than final chunk size (which is aligned) has to fit for alignmentdeps\index.crates.io-1949cf8c6b5b557f\gpu-alloc-0.6.0\src\freelist.rs" Heuristic match: "/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\alloc\src\collections\btree\node.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\glow-0.13.1\src\native.rs" Heuristic match: "wglchoosepixelformatarbwglcopycontextwglcreatecontextwglcreatecontextattribsarbwglcreatelayercontextwglcreatepbufferarbwgldeletecontextwgldescribelayerplanewgldestroypbufferarbwglgetcurrentcontextwglgetcurrentdcwglgetextensionsstringarbwglgetextensionsstri" Heuristic match: "/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\alloc\src\collections\btree\navigate.rs" Heuristic match: "/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\str\pattern.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\arrayvec-0.7.6\src\arrayvec.rs" Heuristic match: "/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\alloc\src\str.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\wgpu-types-22.0.0\src\math.rs" Heuristic match: "`n` failed to convert to `usize`deps\index.crates.io-1949cf8c6b5b557f\ash-0.38.0+1.3.281\src\prelude.rs" Heuristic match: "/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\slice\sort\stable\quicksort.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\wgpu-hal-22.0.0\src\gles\queue.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\naga-22.1.0\src\back\hlsl\help.rs" Heuristic match: "/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\alloc\src\collections\btree\map.rs" Heuristic match: "/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\sync\mpmc\context.rs" Heuristic match: "rust_min_stackdeps\index.crates.io-1949cf8c6b5b557f\wgpu-hal-22.0.0\src\gles\wgl.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\wgpu-hal-22.0.0\src\dx12\command.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\wgpu-hal-22.0.0\src\gles\command.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\wgpu-hal-22.0.0\src\vulkan\instance.rs" Heuristic match: "enumerate_instance_extension_properties() failed/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\sync\mpmc\list.rs" Heuristic match: "/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\sync\mpmc\zero.rs" Heuristic match: "/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\alloc\src\collections\btree\map\entry.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\wgpu-hal-22.0.0\src\dx12\descriptor.rs" Heuristic match: "/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\sync\mpmc\array.rs" Heuristic match: "failed to load dxgi.dlldeps\index.crates.io-1949cf8c6b5b557f\wgpu-hal-22.0.0\src\auxil\dxgi\exception.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\rustc-hash-1.1.0\src\lib.rs" Heuristic match: "internal error: no layout entry found with binding slotdeps\index.crates.io-1949cf8c6b5b557f\wgpu-hal-22.0.0\src\gles\device.rs" Heuristic match: "entry::create_instance() failedenumerate_instance_layer_properties() faileddeps\index.crates.io-1949cf8c6b5b557f\wgpu-hal-22.0.0\src\dx12\device.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\gpu-alloc-0.6.0\src\slab.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\wgpu-hal-22.0.0\src\gles\conv.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\wgpu-hal-22.0.0\src\gles\adapter.rs" Heuristic match: "/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\sync\mpmc\waker.rs" Heuristic match: "could not lock adapter context. this is most-likely a deadlock.deps\index.crates.io-1949cf8c6b5b557f\wgpu-hal-22.0.0\src\vulkan\conv.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\wgpu-hal-22.0.0\src\vulkan\adapter.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\ash-0.38.0+1.3.281\src\instance.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\wgpu-hal-22.0.0\src\auxil\renderdoc.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\wgpu-hal-22.0.0\src\lib.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\wgpu-hal-22.0.0\src\dx12\view.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\wgpu-hal-22.0.0\src\dx12\adapter.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\wgpu-hal-22.0.0\src\auxil\dxgi\time.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\wgpu-hal-22.0.0\src\dx12\shader_compilation.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\wgpu-hal-22.0.0\src\dx12\conv.rs" Heuristic match: "unlabeled bufferdeps\index.crates.io-1949cf8c6b5b557f\wgpu-hal-22.0.0\src\dx12\suballocation.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\wgpu-hal-22.0.0\src\auxil\dxgi\conv.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\wgpu-hal-22.0.0\src\vulkan\command.rs" Heuristic match: "a display implementation returned an error unexpectedly/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\alloc\src\string.rs" Heuristic match: "/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\alloc\src\vec\spec_from_iter_nested.rs" Heuristic match: "/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\slice\index.rs" Heuristic match: "object has been over-released.deps\index.crates.io-1949cf8c6b5b557f\windows-core-0.52.0\src\imp\ref_count.rs" Heuristic match: "iunknownallocation faileddeps\index.crates.io-1949cf8c6b5b557f\windows-registry-0.6.1\src\data.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\winit-0.30.13\src\platform_impl\windows\drop_handler.rs" Heuristic match: "/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\sync\once.rs" Heuristic match: "internal error: entered unreachable yode/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\sys\thread_local\native\lazy.rs" Heuristic match: "/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\std\src\thread\local.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\winit-0.30.13\src\platform_impl\windows\event_loop\runner.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\winit-0.30.13\src\platform_impl\windows\event_loop.rs" Heuristic match: "assertion failed: validate_scale_factor(scale_factor)deps\index.crates.io-1949cf8c6b5b557f\dpi-0.1.2\src\lib.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\smol_str-0.2.2\src\lib.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\winit-0.30.13\src\platform_impl\windows\window.rs" Heuristic match: "found an incomplete pending message when collecting messages. this indicates a bug in winit.deps\index.crates.io-1949cf8c6b5b557f\winit-0.30.13\src\platform_impl\windows\keyboard.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\winit-0.30.13\src\platform_impl\windows\icon.rs" Heuristic match: "winit thread event targetdeps\index.crates.io-1949cf8c6b5b557f\winit-0.30.13\src\platform_impl\windows\dpi.rs" Heuristic match: "/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\num\f64.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\winit-0.30.13\src\platform_impl\windows\util.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\winit-0.30.13\src\platform_impl\windows\window_state.rs" Heuristic match: "5b557f\winit-0.30.13\src\platform_impl\windows\keyboard_layout.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\winit-0.30.13\src\platform_impl\windows\monitor.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\unicode-segmentation-1.13.2\src\grapheme.rs" Heuristic match: "/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\alloc\src\sync.rs" Heuristic match: "/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\char\methods.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\zune-jpeg-0.5.15\src\worker.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\zune-jpeg-0.5.15\src\color_convert\scalar.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\zune-jpeg-0.5.15\src\upsampler\avx2.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\zune-jpeg-0.5.15\src\huffman.rs" Heuristic match: "mid > lenchunk size must be non-zero/qustc/52b6e2c208b73276ccb36ec0b68456913a801c96/library\core\src\slice\iter.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\zune-jpeg-0.5.15\src\misc.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\zune-jpeg-0.5.15\src\color_convert\avx.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\zune-jpeg-0.5.15\src\idct\avx2.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\zune-jpeg-0.5.15\src\idct\scalar.rs" Heuristic match: "deps\index.crates.io-1949cf8c6b5b557f\zune-jpeg-0.5.15\src\upsampler\scalar.rs" Heuristic match: "2\cmd.eg" Heuristic match: ".data.rel.ro"36:T59d,Found string "\Device\Afd\Mio" (Indicator: "\Device\"; File: "draftview.exe") Found string "\Device\NamedPipe\" (Indicator: "\Device\"; File: "draftview.exe") Found string "deps\index.crates.io-1949cf8c6b5b557f\wgpu-core-22.1.0\src\device\global.rs" (Indicator: "\Device\"; File: "draftview.exe") Found string "deps\index.crates.io-1949cf8c6b5b557f\wgpu-core-22.1.0\src\device\mod.rv" (Indicator: "\Device\"; File: "draftview.exe") file/memory contains long string with (Indicator: "\Device\"; File: "draftview.exe") Found string "assertion failed: self.sorteddeps\index.crates.io-1949cf8c6b5b557f\wgpu-core-22.1.0\src\device\bgl.rs" (Indicator: "\Device\"; File: "draftview.exe") Found string "deps\index.crates.io-1949cf8c6b5b557f\wgpu-core-22.1.0\src\device\resource.rs" (Indicator: "\Device\"; File: "draftview.exe") Found string "..deps\index.crates.io-1949cf8c6b5b557f\wgpu-core-22.1.0\src\device\queue.rs" (Indicator: "\Device\"; File: "draftview.exe") Found string "\Device\HarddiskVolume3\draftview.exe" (Indicator: "\Device\"; Source: "00000000-00005364.00000001.207901.796B0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00005364.00000001.207901.796B0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00005364.00000001.207901.796B0000.00000004.mdmp")37:T1239,"draftview.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\SLDWORKS"; Key: "EXTENSION:GL_NV_PRIMITIVE_RESTART"; Value: "disable") "draftview.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\HEAVEN"; Key: "EXTENSION:GL_EXT_FRAMEBUFFER_MULTISAMPLE"; Value: "enable") "draftview.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\HEAVEN"; Key: "ALLOWGLSLEXTENSIONDIRECTIVEMIDSHADER"; Value: "enable") "draftview.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\HEAVEN64"; Key: "EXTENSION:GL_EXT_FRAMEBUFFER_MULTISAMPLE"; Value: "enable") "draftview.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\HEAVEN64"; Key: "ALLOWGLSLEXTENSIONDIRECTIVEMIDSHADER"; Value: "enable") "draftview.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\UNIGINE"; Key: "EXTENSION:GL_EXT_FRAMEBUFFER_MULTISAMPLE"; Value: "enable") "draftview.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\UNIGINE"; Key: "ALLOWGLSLEXTENSIONDIRECTIVEMIDSHADER"; Value: "enable") "draftview.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\VALLEY"; Key: "EXTENSION:GL_EXT_FRAMEBUFFER_MULTISAMPLE"; Value: "enable") "draftview.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\VALLEY"; Key: "ALLOWGLSLEXTENSIONDIRECTIVEMIDSHADER"; Value: "enable") "draftview.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\JK2SP"; Key: "EXTENSIONMAXYEAR"; Value: "D807000000") "draftview.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\CODSP"; Key: "EXTENSIONMAXYEAR"; Value: "D807000000") "draftview.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\CODSP_NOCD"; Key: "EXTENSIONMAXYEAR"; Value: "D807000000") "draftview.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\VIEWPERF"; Key: "GLSLVERSION"; Value: "7800000000") "draftview.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\GPUTEST"; Key: "GLSLVERSION"; Value: "8200000000") "draftview.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\GPUTESTGUI"; Key: "GLSLVERSION"; Value: "8200000000") "draftview.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\NOBELCLINICIANVIEWER"; Key: "EXTENSION:GL_ARB_TEXTURE_RG"; Value: "enable") "draftview.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\PHOTOSHOP"; Key: "ALLOWGLSLEXTENSIONDIRECTIVEMIDSHADER"; Value: "enable") "draftview.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\RECAP"; Key: "OPENGLPROFILE"; Value: "Compat") "draftview.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\RECAP"; Key: "OPENGLVERSION"; Value: "2000000000") "draftview.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\RECAP"; Key: "GLSLVERSION"; Value: "8200000000") "draftview.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\SHADERTOYMARK"; Key: "OPENGLVERSION"; Value: "1E00000000") "draftview.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\SWKOTOR"; Key: "EXTENSION:GL_ATI_FRAGMENT_SHADER"; Value: "disable") "draftview.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\SPAZIO3D"; Key: "USE_SOFTWARE_XOR_COPYPIXELS"; Value: "0100000000") "draftview.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\GLOBAL_MAPPER"; Key: "OPENGLPROFILE"; Value: "Compat") "draftview.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\GLOBAL_MAPPER"; Key: "OPENGLVERSION"; Value: "2100000000") "draftview.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\GLOBAL_MAPPER"; Key: "GLSLVERSION"; Value: "4A01000000") "draftview.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS"; Key: "SETTINGS.VERSION"; Value: "6B00000000")38:T81a,"draftview.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\") "draftview.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\SLDWORKS") "draftview.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.") "draftview.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER") "draftview.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS") "draftview.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\HEAVEN") "draftview.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\HEAVEN64") "draftview.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\UNIGINE") "draftview.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\VALLEY") "draftview.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\JK2SP") "draftview.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\CODSP") "draftview.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\CODSP_NOCD") "draftview.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\VIEWPERF") "draftview.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\GPUTEST") "draftview.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\GPUTESTGUI") "draftview.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\NOBELCLINICIANVIEWER") "draftview.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\PHOTOSHOP") "draftview.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\RECAP") "draftview.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\SHADERTOYMARK") "draftview.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\SWKOTOR") "draftview.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\SPAZIO3D") "draftview.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\GLOBAL_MAPPER")39:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIiIiAAAAAAAAAAAAAAACIiIiIiIgAAAAAAAAAAACIiHEXcReIiAAAAAAAAAAIiFd4iIiHdYiAAAAAAAAAiHWIiIiIiIhXiAAAAAAACId4iIiHeIiIh3iAAAAAAIh3iIiIcReIiIh3iAAAAACIWIiIiHEXiIiIhYgAAAAIhYiIeIiBGIiHiIhYgAAACIeIgReIiIiIcRiIeIAAAAh3iIERiIiIiBEYiHeAAACIGIiBEYiIiIgRGIiBiAAAiBiIiFiIiIiIhYiIgYgAAIh4iIiIiIiIiIiIiIeIAACIeIiIiIiIiIiIiIiHiAAAiBiIiFiIiIiIhYiIgYgAAIgYiIERiIiIiBEYiIGIAAAId4iBEYiIiIgRGIh3gAAACIeIgReIiIiIcRiIeIAAAAiFiIh4iIEYiIeIiFiAAAAAiFiIiIhxF4iIiIWIAAAAAIh3iIiIcReIiIh3iAAAAAAIh3iIiId4iIiHeIAAAAAAAIh1iIiIiIiIV4gAAAAAAAAIiFd4iIiHdYiAAAAAAAAAAIiIcRdxF4iIAAAAAAAAAAAAiIiIiIiIAAAAAAAAAAAAAAAIiIiAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD////////////4H///wAP//wAA//4AAH/8AAA/+AAAH/AAAA/wAAAP4AAAB+AAAAfgAAAHwAAAA8AAAAPAAAADwAAAA8AAAAPAAAAD4AAAB+AAAAfgAAAH8AAAD/AAAA/4AAAf/AAAP/4AAH//AAD//8AD///4H////////////w==3a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIiIiAAAAAAAAAAAAAAACIiIiIiIgAAAAAAAAAAACIiHEXcReIiAAAAAAAAAAIiFd4iIiHdYiAAAAAAAAAiHWIiIiIiIhXiAAAAAAACId4iIiHeIiIh3iAAAAAAIh3iIiIcReIiIh3iAAAAACIWIiIiHEXiIiIhYgAAAAIhYiIeIiBGIiHiIhYgAAACIeIgReIiIiIcRiIeIAAAAh3iIERiIiIiBEYiHeAAACIGIiBEYiIiIgRGIiBiAAAiBiIiFiIiIiIhYiIgYgAAIh4iIiIiIiIiIiIiIeIAACIeIiIiIiIiIiIiIiHiAAAiBiIiFiIiIiIhYiIgYgAAIgYiIERiIiIiBEYiIGIAAAId4iBEYiIiIgRGIh3gAAACIeIgReIiIiIcRiIeIAAAAiFiIh4iIEYiIeIiFiAAAAAiFiIiIhxF4iIiIWIAAAAAIh3iIiIcReIiIh3iAAAAAAIh3iIiId4iIiHeIAAAAAAAIh1iIiIiIiIV4gAAAAAAAAIiFd4iIiHdYiAAAAAAAAAAIiIcRdxF4iIAAAAAAAAAAAAiIiIiIiIAAAAAAAAAAAAAAAIiIiAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD////////////4H///wAP//wAA//4AAH/8AAA/+AAAH/AAAA/wAAAP4AAAB+AAAAfgAAAHwAAAA8AAAAPAAAADwAAAA8AAAAPAAAAD4AAAB+AAAAfgAAAH8AAAD/AAAA/4AAAf/AAAP/4AAH//AAD//8AD///4H////////////w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"f9ff28b32522bf4ac0e8f9fa1b392ce43bd26d0b6b70d4c521a2ad67f4a8cbed","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1793328360824,"unified_at":"2026-10-30T02:46:00.824Z","metadata":{"hashes":{"sha256":"f9ff28b32522bf4ac0e8f9fa1b392ce43bd26d0b6b70d4c521a2ad67f4a8cbed","sha1":"93cd326accc4fb9787444f588032e859027edc5b","md5":"d6d41b1be10b42583465694f24efa431","sha512":"5545f436ebc94de1ecc283d2c41e539807804e5d1757f235f3cdc44d84bfd301f50b23d62e067a2fb97f9be54580c7f705ec3cd8973a7798adbd27571e896f14","ssdeep":"98304:AHxytrL7qYXTZtk3t3bvoDTAXbO8EPF4wuy9Di2HJXbDQ6yxKibkkMsEk8cQ:AHxuC9DoD9yy9DhpQ6yxKi0","ssdeep_chunks":["98304:AHxytrL","98304:HxytrL7","98304:xytrL7q","98304:ytrL7qY","98304:trL7qYX","98304:rL7qYXT","98304:L7qYXTZ","98304:7qYXTZt","98304:qYXTZtk","98304:YXTZtk3","98304:XTZtk3t","98304:TZtk3t3","98304:Ztk3t3b","98304:tk3t3bv","98304:k3t3bvo","98304:3t3bvoD","98304:t3bvoDT","98304:3bvoDTA","98304:bvoDTAX","98304:voDTAXb","98304:oDTAXbO","98304:DTAXbO8","98304:TAXbO8E","98304:AXbO8EP","98304:XbO8EPF","98304:bO8EPF4","98304:O8EPF4w","98304:8EPF4wu","98304:EPF4wuy","98304:PF4wuy9","98304:F4wuy9D","98304:4wuy9Di","98304:wuy9Di2","98304:uy9Di2H","98304:y9Di2HJ","98304:9Di2HJX","98304:Di2HJXb","98304:i2HJXbD","98304:2HJXbDQ","98304:HJXbDQ6","98304:JXbDQ6y","98304:XbDQ6yx","98304:bDQ6yxK","98304:DQ6yxKi","98304:Q6yxKib","98304:6yxKibk","98304:yxKibkk","98304:xKibkkM","98304:KibkkMs","98304:ibkkMsE","98304:bkkMsEk","98304:kkMsEk8","98304:kMsEk8c","98304:MsEk8cQ","196608:AHxytrL","196608:HxytrL7","196608:xytrL7q","196608:ytrL7qY","196608:trL7qYX","196608:rL7qYXT","196608:L7qYXTZ","196608:7qYXTZt","196608:qYXTZtk","196608:YXTZtk3","196608:XTZtk3t","196608:TZtk3t3","196608:Ztk3t3b","196608:tk3t3bv","196608:k3t3bvo","196608:3t3bvoD","196608:t3bvoDT","196608:3bvoDTA","196608:bvoDTAX","196608:voDTAXb","196608:oDTAXbO","196608:DTAXbO8","196608:TAXbO8E","196608:AXbO8EP","196608:XbO8EPF","196608:bO8EPF4","196608:O8EPF4w","196608:8EPF4wu","196608:EPF4wuy","196608:PF4wuy9","196608:F4wuy9D","196608:4wuy9Di","196608:wuy9Di2","196608:uy9Di2H","196608:y9Di2HJ","196608:9Di2HJX","196608:Di2HJXb","196608:i2HJXbD","196608:2HJXbDQ","196608:HJXbDQ6","196608:JXbDQ6y","196608:XbDQ6yx","196608:bDQ6yxK","196608:DQ6yxKi","196608:Q6yxKib","196608:6yxKibk","196608:yxKibkk","196608:xKibkkM","196608:KibkkMs","196608:ibkkMsE","196608:bkkMsEk","196608:kkMsEk8","196608:kMsEk8c","196608:MsEk8cQ","98304:AHxuC9D","98304:HxuC9Do","98304:xuC9DoD","98304:uC9DoD9","98304:C9DoD9y","98304:9DoD9yy","98304:DoD9yy9","98304:oD9yy9D","98304:D9yy9Dh","98304:9yy9Dhp","98304:yy9DhpQ","98304:y9DhpQ6","98304:9DhpQ6y","98304:DhpQ6yx","98304:hpQ6yxK","98304:pQ6yxKi","98304:Q6yxKi0"],"imphash":"fb7a1b378781f1a8d7e8a56c2e2100c0"},"file_info":{"file_name":"draftview.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":11352880,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1792426233000,"last_seen":1792581393000,"last_multi_scan":1792581393000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["evasive"]},"stats":{"av":{"malicious_count":6,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":72},"sandbox_signatures":{"informative_count":152,"suspicious_count":11,"malicious_count":1,"total":164},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Win64_PSW_Agent_AXJ_trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win64/PSW.Agent.AXJ trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Password-Stealer ( 006e91e31 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W64/ABTrojan.TTHB-6440","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_100%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"Firmware","attack_id":"T1592.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1592/003","identifiers":[{"type":"informative","value":"Able to gather system firmware table (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"suspicious","value":"Contains native function calls"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"suspicious","value":"Imports suspicious APIs"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Contains ability to create named pipes for inter-process communication (IPC)"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"suspicious","value":"Contains ability to update the user profile"},{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","identifiers":[{"type":"suspicious","value":"Able to start/interact with device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Credential Access","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"informative","value":"Contains ability to register/read input devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"informative","value":"Able to access web session cookie"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Queries the user identity associated with the current process token"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"suspicious","value":"Reads VM-specific registry key"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve information about the current system"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Calls an API used to retrieve geographical location information"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Calls an API used to retrieve process information"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Discovery","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Contains ability to retrieve system language"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Contains ability to detect sandbox (imports API)"},{"type":"informative","value":"The input sample contains the RDTSCP instruction"},{"type":"informative","value":"Able to detect virtual machine (string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Discovery","technique":"Internet Connection Discovery","attack_id":"T1016.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/001","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"suspicious","value":"Contains ability to perform NetBIOS scans using Winsock API"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"suspicious","value":"Contains ability to create directories"},{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Able to capture drag-drop file operations"},{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"suspicious","value":"Contains ability to open a port and listen for incoming connection"},{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found string related to HTTP headers"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains ability to encrypt/encode message (API string)"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Stealth","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Stealth","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"},{"type":"informative","value":"Spawns Windows crash diagnostic and reporting process"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Stealth","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Stealth","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Stealth","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy resources"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Stealth","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","identifiers":[{"type":"suspicious","value":"File exhibits characteristics of junk code obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Stealth","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"tactic":"Defense Impairment","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a valid certificate"},{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"enable-name-compression\" (Source: \"00000000-00005364.00000001.207901.796B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"draftview.exe\")\n Found reference to API \"vkFreeMemory\" (Indicator: \"FreeMemory\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"draftview.exe\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; File: \"draftview.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"draftview.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"draftview.exe\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"draftview.exe\")\n file/memory contains long string with (Indicator: \"FreeLibrary\"; File: \"draftview.exe\")\n file/memory contains long string with (Indicator: \"LoadLibrary\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\NUL; Source: \"draftview.exe\")\n Found string - \\\\.\\DISPLAY8; Source: \"00000000-00005364.00000000.206743.A3B30000.00000004.mdmp, 00000000-00005364.00000001.207901.796B0000.00000004.mdmp, 00000000-00005364.00000001.207901.A3B30000.00000004.mdmp\")\n Found string - \\\\.\\DISPLAY1; Source: \"00000000-00005364.00000001.207901.796B0000.00000004.mdmp\")\n Found string - \\\\.\\DISPLAY2; Source: \"00000000-00005364.00000001.207901.796B0000.00000004.mdmp\")\n Found string - \\\\.\\DISPLAY3; Source: \"00000000-00005364.00000001.207901.796B0000.00000004.mdmp\")\n Found string - \\\\.\\DISPLAY4; Source: \"00000000-00005364.00000001.207901.796B0000.00000004.mdmp\")\n Found string - \\\\.\\DISPLAY5; Source: \"00000000-00005364.00000001.207901.796B0000.00000004.mdmp\")\n Found string - \\\\.\\DISPLAY6; Source: \"00000000-00005364.00000001.207901.796B0000.00000004.mdmp\")\n Found string - \\\\.\\DISPLAY7; Source: \"00000000-00005364.00000001.207901.796B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"draftview.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"draftview.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"draftview.exe\" queried SystemProcessInformation at 00000000-00005364-00000C15-1992487470 [PID: 5364]\n \"draftview.exe\" queried SystemProcessInformation at 00000000-00005364-00000C15-1992493692 [PID: 5364]\n \"draftview.exe\" queried SystemProcessInformation at 00000000-00005364-00000C15-1992666082 [PID: 5364]\n \"draftview.exe\" queried SystemProcessInformation at 00000000-00005364-00000C15-1992672294 [PID: 5364]\n \"draftview.exe\" queried SystemProcessInformation at 00000000-00005364-00000C15-1993582365 [PID: 5364]\n \"draftview.exe\" queried SystemProcessInformation at 00000000-00005364-00000C15-1993588959 [PID: 5364]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Spawns Windows crash diagnostic and reporting process","description":"Process \"WerFault.exe\" [UID: 00000000-00004720]\n Process \"WerFault.exe\" [UID: 00000000-00003720]\n Process \"WerFault.exe\" [UID: 00000000-00002480]","origin":"Monitored Target","mitre_attack_id":"T1564","relevance":1,"id":"target-585","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"draftview.exe\")\n Found reference to API \"NtQueryInformationProcess\" (Indicator: \"NtQueryInformationProcess\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"draftview.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 48993-12717-0000000151977520","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$28","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$29","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/encode message (API string)","description":"Found reference to API \"EncryptMessage\" (Indicator: \"EncryptMessage\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-213","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CertFreeCertificateContext\" (Indicator: \"CertFreeCertificateContext\"; File: \"draftview.exe\")\n Found reference to API \"CertEnumCertificatesInStore\" (Indicator: \"CertEnumCertificatesInStore\"; File: \"draftview.exe\")\n Found reference to API \"CertCloseStore\" (Indicator: \"CertCloseStore\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"DecryptMessage\" (Indicator: \"DecryptMessage\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00005364.00000001.207901.796B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Contains ability to perform decryption (API string)\n Matched sigs: Contains ability to encrypt/encode message (API string)\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2a","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"file/memory contains long string with (Indicator: \"github.com\"; File: \"draftview.exe\")\n Found string \"internal error: entered unreachable Yode: This is validated out until a polyfill is implemented. https://github.com/gfx-rs/wgpu/issues/5276\" (Indicator: \"github.com\"; File: \"draftview.exe\")\n Found string \"> arguments yet, see https://github.com/gfx-rs/wgpu/issues/5276\" (Indicator: \"github.com\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Environment Awareness","name":"Able to detect virtual machine (string)","description":"Found string \":\\WINDOWS\\SYSTEM32\\vm3dglhelper64.dll\" (Source: \"00000000-00005364.00000001.207901.796B0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SYSTEM32\\vm3dgl64.dll\" (Source: \"00000000-00005364.00000001.207901.796B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-989","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system firmware table (API string)","description":"file/memory contains long string(File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1592.003","relevance":1,"id":"string-902","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"GetSystemFirmwareTable\" (Indicator: \"GetSystemFirmwareTable\"; File: \"draftview.exe\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"draftview.exe\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; File: \"draftview.exe\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetEnvironmentStringsW\" in file \"draftview.exe\"\n Found system information discovery API: \"GetSystemInfo\" in file \"draftview.exe\"\n Found system information discovery API: \"NtQuerySystemInformation\" in file \"draftview.exe\"\n Found system information discovery API: \"RtlNtStatusToDosError\" in file \"draftview.exe\"\n Found system information discovery API: \"GetMonitorInfoW\" in file \"draftview.exe\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; File: \"draftview.exe\")\n Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; File: \"draftview.exe\")\n Found reference to API \"PostMessage failed; is the messages queue full?\" (Indicator: \"postmessage\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"draftview.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00005364)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"draftview.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00005364)\n \"draftview.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00005364)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"draftview.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005364)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"draftview.exe\" called \"IsWow64Process\" with parameter \"5364\" - (UID: 00000000-00005364)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"draftview.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005364)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2b","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve geographical location information","description":"Observed import api \"getaddrinfo\" which can be \"used to convert host name to address\" [Source: draftview.exe]","origin":"Static Parser","mitre_attack_id":"T1082","relevance":5,"id":"static-190","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: draftview.exe]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileExW@KERNEL32.dll at 48993-25386-00000001517792E5","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 48993-49137-000000015197735A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimePreciseAsFileTime@KERNEL32.dll at 48993-12844-000000015178AA50\n GetSystemTimeAsFileTime@KERNEL32.dll at 48993-49137-000000015197735A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"RtlGetVersion@ntdll.dll at 48993-25860-000000015179B0D4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"draftview.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"Set must be allocated from this allocator\" (Indicator: \"set \"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system","description":"GetSystemInfo@KERNEL32.dll at 48993-22237-00000001517077D3\n GetSystemInfo@KERNEL32.dll at 48993-25954-000000015179F0F2","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; File: \"draftview.exe\")\n Found reference to API \"GetWindowTextLengthW\" (Indicator: \"GetWindowText\"; File: \"draftview.exe\")\n Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"draftview.exe\")\n Found reference to API \"GetWindowTextW\" (Indicator: \"GetWindowText\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language","description":"GetKeyboardLayout@user32.dll at 48993-13161-000000015195EF73","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614.001","relevance":3,"id":"stream-79","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"GetVersion\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@KERNEL32.dll at 48993-78-0000000151783770\n GetProcessHeap@KERNEL32.dll at 48993-17316-000000015195A66B\n GetProcessHeap@KERNEL32.dll at 48993-17319-000000015195A55F\n GetProcessHeap@KERNEL32.dll at 48993-22446-000000015161535B\n GetProcessHeap@KERNEL32.dll at 48993-22447-000000015195ADB0\n OpenProcessToken@ADVAPI32.dll at 48993-24895-0000000151760949\n GetProcessHeap@KERNEL32.dll at 48993-25893-000000015179C827\n GetProcessHeap@KERNEL32.dll at 48993-28112-000000015195A70B\n GetProcessHeap@KERNEL32.dll at 48993-34803-000000015195AF9D","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"draftview.exe\" queried token user identity (UID: 00000000-00005364)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"draftview.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"draftview.exe\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"svchost.exe\"\n Report process \"WerFault.exe\" was created by \"draftview.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2c","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2d","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"General","name":"Contains ability to create named pipes for inter-process communication (IPC)","description":"NtCreateNamedPipeFile@ntdll.dll at 48993-25759-00000001517951F0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1559","relevance":10,"id":"stream-45","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"NtDeviceIoControlFile\" (Indicator: \"NtDeviceIoControlFile\"; File: \"draftview.exe\")\n Found reference to API \"NtDeviceIoControlFile\" (Indicator: \"DeviceIoControl\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"draftview.exe\")\n Found reference to API \"NtOpenFile\" (Indicator: \"NtOpenFile\"; File: \"draftview.exe\")\n Found reference to API \"NtCreateFile\" (Indicator: \"CreateFile\"; File: \"draftview.exe\")\n Found reference to API \"NtCreateFile\" (Indicator: \"NtCreateFile\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"WaitForSingleObject@KERNEL32.dll at 48993-5274-0000000151B61560\n WaitForSingleObject@KERNEL32.dll at 48993-12793-0000000151799630\n WaitForSingleObject@KERNEL32.dll at 48993-12796-0000000151789CF0\n WaitForSingleObject@KERNEL32.dll at 48993-12814-00000001517832E0\n WaitForSingleObjectEx@KERNEL32.dll at 48993-12849-000000015177F570\n Sleep@KERNEL32.dll at 48993-13074-00000001516FCB8A\n Sleep@KERNEL32.dll at 48993-13081-00000001516FCB9D\n Sleep@KERNEL32.dll at 48993-13273-00000001517990F0\n WaitForSingleObject@KERNEL32.dll at 48993-13565-00000001517CEEBD\n WaitForSingleObject@KERNEL32.dll at 48993-13626-0000000151797370\n WaitForSingleObject@KERNEL32.dll at 48993-13627-000000015178AA80\n MsgWaitForMultipleObjectsEx at 48993-13715-000000015196A6B2\n WaitForSingleObject@KERNEL32.dll at 48993-30820-0000000151882563","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: draftview.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryA@KERNEL32.dll at 48993-12849-000000015177F570\n LoadLibraryExW@KERNEL32.dll at 48993-13820-0000000151607E63\n LoadLibraryExW@KERNEL32.dll at 48993-13833-000000015155631C\n LoadLibraryA@KERNEL32.dll at 48993-13836-0000000151957166\n LoadLibraryW@KERNEL32.dll at 48993-14798-00000001515F3619\n LoadLibraryExA@KERNEL32.dll at 48993-17313-000000015195A21C\n LoadLibraryExA@KERNEL32.dll at 48993-34803-000000015195AF9D\n LoadLibraryA@KERNEL32.dll at 48993-34865-000000015195DCDE","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"draftview.exe\")\n Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"draftview.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"draftview.exe\")\n Found reference to API \"WSAGetLastError\" (Indicator: \"GetLastError\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Internet SettingsProxyEnableProxyServerProxyOverride*.invalid URL, scheme is not httpinvalid URL, host is missinginvalid URL, scheme is missingtcp open errortcp set_nonblocking errortcp bind local error\" in Source: draftview.exe","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process draftview.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:5364:304:WilStaging_02\"\n Process draftview.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5364:304:WilStaging_02\"\n Process draftview.exe created mutex with name \"Local\\SM0:5364:304:WilStaging_02\"\n Process draftview.exe created mutex with name \"SM0:5364:304:WilStaging_02\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"draftview.exe\" failed to load missing module \"vulkan-1.dll\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"draftview.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"$2f","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$30","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"draftview.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at D99F0000\n \"draftview.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at D92D0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"draftview.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at DC090000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"draftview.exe\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"draftview.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"draftview.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"draftview.exe\" has an writable section named \".data\"\n \"draftview.exe\" has an writable section named \".tls\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"draftview.exe\" file has an entrypoint instructions - \"sub\trsp, 0x28,call\t0x151977340,add\trsp, 0x28,jmp\t0x151976f30,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,push\trbx,sub\trsp, 0x20,cmp\tqword ptr [rip + 0x64feda], -1,mov\trbx, rcx,jne\t0x1519770ea,call\t0x151b61b00,jmp\t0x1519770f9,mov\trdx, rbx,lea\trcx, [rip + 0x64fec4],call\t0x151b61af0,xor\tedx, edx,test\teax, eax,cmove\trdx, rbx,neg\trdx,sbb\teax, eax,neg\teax,dec\teax,add\trsp, 0x20,pop\trbx,ret\t,sub\trsp, 0x18,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x630c00\" greater than 0x100000\n Raw size of \".rdata\" is \"0x453800\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x630b06\" greater than 0x100000\n Virtual size of \".rdata\" is \"0x4536f4\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"draftview.exe\" has high imagebase \"0x151530000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\explorer.exe\" [Source: 00000000-00005364-00000BC0-1992942507]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"draftview.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"draftview.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"General","name":"The input sample contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 7463462)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=Microsoft Identity Verification Root Certificate Authority 2020, O=Microsoft Corporation, C=US\" (SHA1: F4:00:42:E2:E5:F7:E8:EF:81:89:FE:D1:55:19:AE:CE:42:C3:BF:A2; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Microsoft ID Verified CS EOC CA 04, O=Microsoft Corporation, C=US\" (SHA1: F8:D2:CC:57:47:E0:D9:00:06:CB:F7:B6:A2:B8:36:05:EC:41:6D:19; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Microsoft ID Verified Code Signing PCA 2021, O=Microsoft Corporation, C=US\" (SHA1: 4F:D4:16:36:DC:2A:CD:FB:D5:A8:C4:71:18:6E:43:DF:7D:BF:B3:84; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Microsoft Identity Verification Root Certificate Authority 2020, O=Microsoft Corporation, C=US\" (SHA1: 8E:75:0F:45:9D:AF:9A:79:D6:37:0D:B7:47:AD:22:26:86:6A:D8:18; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"General","name":"The input sample is signed with a valid certificate","description":"The entire certificate chain of the input sample was validated successfully.","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-2","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"draftview.exe\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; File: \"draftview.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"draftview.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"draftview.exe\")\n file/memory contains long string with (Indicator: \"LoadLibrary\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"draftview.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$31","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"draftview.exe\" queries basic process information of the \"C:\\draftview.exe\" (UID: 5364)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$32","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Able to detect virtual machine (string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to detect virtual machine (file access)\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Able to perform sandbox evasion using APIs\n Matched sigs: Contains ability to detect sandbox (imports API)\n Matched sigs: The input sample contains a known anti-VM trick\n Matched sigs: The input sample contains the RDTSCP instruction\n Matched sigs: Contains ability to delay the execution of current thread","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"draftview.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\apphelp.dll\"\n \"draftview.exe\" trying to touch file \"C:\\Windows\\System32\\apphelp.dll\"\n \"draftview.exe\" trying to touch file \"C:\\draftview.exe\"\n \"draftview.exe\" trying to touch file \"C:\\Windows\\System32\\ntdll.dll\"\n \"draftview.exe\" trying to touch file \"C:\\Windows\\System32\\kernel32.dll\"\n \"draftview.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"draftview.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"draftview.exe\" trying to touch file \"C:\\Windows\\apppatch\\MergeSdbFilesSource\\sysMerge.sdb\"\n \"draftview.exe\" trying to touch file \"C:\\dwmapi.dll\"\n \"draftview.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\dwmapi.dll\"\n \"draftview.exe\" trying to touch file \"C:\\bcrypt.dll\"\n \"draftview.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\bcrypt.dll\"\n \"draftview.exe\" trying to touch file \"C:\\Windows\\System32\\dwmapi.dll\"\n \"draftview.exe\" trying to touch file \"C:\\Windows\\System32\\bcrypt.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$33","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSASend\" (Indicator: \"WSASend\"; File: \"draftview.exe\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSASend\" (Indicator: \"WSASend\"; File: \"draftview.exe\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"NtCreateNamedPipeFile\" (Indicator: \"CreateNamedPipe\"; File: \"draftview.exe\")\n Found reference to API \"vkCreatePipelineCache\" (Indicator: \"CreatePipe\"; File: \"draftview.exe\")\n Found reference to API \"vkCreatePipelineLayout\" (Indicator: \"CreatePipe\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"127.0.0.1:34254socket != -1\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$35","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"file/memory contains long string with (Indicator: \"HTTP/1.1\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://registry.khronos.org\"\n Found HTTPS url \"https://docs.rs\"\n Found HTTPS url \"https://www.shadertoy.com\"\n Found HTTPS url \"https://blog.demofox.org\"\n Found HTTPS url \"https://github.com\"\n Found HTTPS url \"https://invalid\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access web session cookie","description":"Found string \"--user-data-dir=C:\\r\\src\\f\\a\\mod.rv\" (Indicator: \"--user-data-dir\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-794","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"DragQueryFileW\" (File: \"draftview.exe\")\n Found string \"GetClipboardData\" (File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"BitBlt\" (Indicator: \"BitBlt\"; File: \"draftview.exe\")\n Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; File: \"draftview.exe\")\n Found reference to API \"GetDC\" (Indicator: \"GetDC\"; File: \"draftview.exe\")\n Found reference to API \"[winit] `GetDC` returned null!\" (Indicator: \"GetDC\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegOpenKeyExW\" in file \"draftview.exe\"\n Found registry query API: \"RegQueryValueExW\" in file \"draftview.exe\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"MapVirtualKeyExW\" (Indicator: \"MapVirtualKey\"; File: \"draftview.exe\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; File: \"draftview.exe\")\n Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; File: \"draftview.exe\")\n Found reference to API \"MapVirtualKeyW\" (Indicator: \"MapVirtualKey\"; File: \"draftview.exe\")\n Found reference to API \"GetAsyncKeyState\" (Indicator: \"GetAsyncKeyState\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; File: \"draftview.exe\")\n Found reference to API \"NtQueryInformationProcess\" (Indicator: \"NtQueryInformationProcess\"; File: \"draftview.exe\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"draftview.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"draftview.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"5364\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"deps\\index.crates.io-1949cf8c6b5b557f\\base64-0.22.1\\src\\engine\\general_purpose\\mod.rv\" (Indicator: \"base64\"; File: \"draftview.exe\")\n Found string \"deps\\index.crates.io-1949cf8c6b5b557f\\base64-0.22.1\\src\\engine\\general_purpose\\decode_suffix.rs\" (Indicator: \"base64\"; File: \"draftview.exe\")\n Found string \"deps\\index.crates.io-1949cf8c6b5b557f\\base64-0.22.1\\src\\engine\\general_purpose\\decode.rs\" (Indicator: \"base64\"; File: \"draftview.exe\")\n Found string \"deps\\index.crates.io-1949cf8c6b5b557f\\base64-0.22.1\\src\\encode.rs\" (Indicator: \"base64\"; File: \"draftview.exe\")\n Found string \"deps\\index.crates.io-1949cf8c6b5b557f\\base64-0.22.1\\src\\write\\encoder.rs\" (Indicator: \"base64\"; File: \"draftview.exe\")\n Found string \"base64 is always valid HeaderValuedeps\\index.crates.io-1949cf8c6b5b557f\\reqwest-0.12.28\\src\\util.rs\" (Indicator: \"base64\"; File: \"draftview.exe\")\n Found string \"deps\\index.crates.io-1949cf8c6b5b557f\\base64-0.22.1\\src\\engine\\mod.rv\" (Indicator: \"base64\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; File: \"draftview.exe\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: draftview.exe)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"draftview.exe\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"draftview.exe\")\n Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; File: \"draftview.exe\")\n Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; File: \"draftview.exe\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; File: \"draftview.exe\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"draftview.exe\")\n Found reference to API \"NtQueryInformationProcess\" (Indicator: \"QueryInformationProcess\"; File: \"draftview.exe\")\n file/memory contains long string with (Indicator: \"GetModuleHandle\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"draftview.exe\")\n Found reference to API \"NtReadFile\" (Indicator: \"NtReadFile\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to register/read input devices (API string)","description":"Found reference to API \"GetRawInputData\" (Indicator: \"GetRawInputData\"; File: \"draftview.exe\")\n Found reference to API \"RegisterRawInputDevices\" (Indicator: \"RegisterRawInputDevices\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1056","relevance":1,"id":"string-403","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"draftview.exe\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"draftview.exe\")\n file/memory contains long string with (Indicator: \"GetModuleHandle\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"draftview.exe\")\n Found reference to API \"wglGetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"draftview.exe\")\n Found reference to API \"eglBindWaylandDisplayWLeglQueryWaylandBufferWLeglUnbindWaylandDisplayWLeglCreateWaylandBufferFromImageWLeglGetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"draftview.exe\")\n file/memory contains long string with (Indicator: \"GetProcAddress\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"file/memory contains long string with (Indicator: \"InterlockedExchange\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetSystemDirectoryW\" (Indicator: \"GetSystemDirectory\"; File: \"draftview.exe\")\n Found reference to API \"GetFileInformationByHandleEx\" (Indicator: \"GetFileInformationByHandle\"; File: \"draftview.exe\")\n Found reference to API \"GetFileInformationByHandle\" (Indicator: \"GetFileInformationByHandle\"; File: \"draftview.exe\")\n Found reference to API \"GetCurrentDirectoryW\" (Indicator: \"GetCurrentDirectory\"; File: \"draftview.exe\")\n Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"draftview.exe\")\n Found reference to API \"GetModuleFileNameExW\" (Indicator: \"GetModuleFileName\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"has_authority means set_password shouldn't fail\" (Indicator: \"password\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"invalid ping frame\" (Indicator: \"ping\"; File: \"draftview.exe\")\n Found string \"received unexpected shutdown ping\" (Indicator: \"ping\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"draftview.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: draftview.exe]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$36","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"ImpersonateAnonymousToken\" (Indicator: \"ImpersonateAnonymousToken\"; File: \"draftview.exe\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; File: \"draftview.exe\")\n Found reference to API \"CopySid\" (Indicator: \"CopySid\"; File: \"draftview.exe\")\n Found reference to API \"IsValidSid\" (Indicator: \"IsValidSid\"; File: \"draftview.exe\")\n Found reference to API \"RevertToSelf\" (Indicator: \"RevertToSelf\"; File: \"draftview.exe\")\n Found reference to API \"GetLengthSid\" (Indicator: \"GetLengthSid\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: draftview.exe","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"draftview.exe\")\n Found reference to API \"NtWriteFile\" (Indicator: \"NtWriteFile\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"Observed import api \"CopySid\" which can \"copy a security identifier (SID) to a buffer\" [Source: draftview.exe]\n Observed import api \"GetLengthSid\" which can \"return the length in bytes of a valid security identifier (SID)\" [Source: draftview.exe]\n Observed import api \"GetTokenInformation\" which can \"retrieve a specified type of information about an access token\" [Source: draftview.exe]\n Observed import api \"ImpersonateAnonymousToken\" which can \"enable the specified thread to impersonate the system's anonymous logon token\" [Source: draftview.exe]\n Observed import api \"IsValidSid\" which can \"validate a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum\" [Source: draftview.exe]\n Observed import api \"RevertToSelf\" which can \"terminate the impersonation of a client application\" [Source: draftview.exe]","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"draftview.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$37","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; File: \"draftview.exe\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; File: \"draftview.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"File exhibits characteristics of junk code obfuscation","description":"Section \".text\" unusually large (6490886 bytes)\n possible junk padding\n Section \".data\" has very low entropy (0.08)\n indicating potential NOP sled\n Section \".tls\" has very low entropy (0.02)\n indicating potential NOP sled","origin":"Static Parser","mitre_attack_id":"T1027.016","relevance":3,"id":"static-9001","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads VM-specific registry key","description":"$38","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-33","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"5/24 Antivirus vendors marked sample as malicious (20% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"suspicious","category":"General","name":"Able to start/interact with device drivers","description":"NtDeviceIoControlFile@ntdll.dll at 48993-19282-000000015166C46E","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1547.006","relevance":5,"id":"stream-21","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"suspicious","category":"General","name":"Contains ability to create directories","description":"CreateDirectoryW@KERNEL32.dll at 48993-18468-000000015178B390","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1074.001","relevance":3,"id":"stream-102","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"draftview.exe\" has resource with unusual entropy \"RT_ICON:7.562589511422888\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection","description":"closesocket@ws2_32.dll at 48993-22457-000000015173E3DE\n closesocket@ws2_32.dll at 48993-22462-00000001517D26C2\n setsockopt@ws2_32.dll at 48993-23824-00000001517D2672\n WSASocketW@ws2_32.dll at 48993-23940-000000015174121B\n setsockopt@ws2_32.dll at 48993-23941-000000015177A026\n bind@ws2_32.dll at 48993-23944-000000015177A001\n bind@ws2_32.dll at 48993-25388-0000000151779CCA\n WSASocketW@ws2_32.dll at 48993-25390-0000000151786590","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1571","relevance":5,"id":"stream-85","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to perform NetBIOS scans using Winsock API","description":"Observed import api \"send\" which can \"perform NetBIOS scans\" [Source: draftview.exe]","origin":"Static Parser","mitre_attack_id":"T1018","relevance":3,"id":"static-195","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains ability to update the user profile","description":"SystemParametersInfoA@user32.dll at 48993-13229-000000015195E27B","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1098","relevance":5,"id":"stream-123","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtReadFile@ntdll.dll at 48993-12793-0000000151799630\n NtReadFile@ntdll.dll at 48993-12796-0000000151789CF0\n NtWriteFile@ntdll.dll at 48993-12814-00000001517832E0\n NtReadFile@ntdll.dll at 48993-13627-000000015178AA80\n NtDeviceIoControlFile@ntdll.dll at 48993-19282-000000015166C46E\n NtCreateNamedPipeFile@ntdll.dll at 48993-25759-00000001517951F0\n NtQueryInformationProcess@ntdll.dll at 48993-25871-000000015179BBA3\n NtQueryInformationProcess@ntdll.dll at 48993-25886-000000015179CA0C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCloseKey\n OpenProcessToken\n RegOpenKeyExW\n CreateThread\n LoadLibraryW\n WriteFileEx\n GetSystemDirectoryW\n CopyFileExW\n LoadLibraryExA\n SleepEx\n GetModuleHandleA\n CreateDirectoryW\n LoadLibraryA\n CreateFileW\n FindNextFileW\n Sleep\n CreateProcessW\n LoadLibraryExW\n GetModuleFileNameW\n OpenProcess\n FindFirstFileExW\n GetModuleHandleW\n GetCommandLineW\n DeleteFileW\n WriteFile\n GetFileAttributesW\n ReadProcessMemory\n GetProcAddress\n GetSystemInfo\n NtQueryInformationProcess\n GetModuleFileNameExW\n GetClipboardData\n GetCursorPos\n WSASend\n bind\n send\n WSAStartup\n recv\n WSASocketW\n closesocket\n connect","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]}],"incidents":[{"name":"Spyware","details_count":3,"details":[{"detail":"Contains ability to register/read input devices (often used for keylogging)"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Contains ability to read clipboard data"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"name":"Evasive","details_count":4,"details":[{"detail":"The input sample contains a known anti-VM trick"},{"detail":"Reads VM-specific registry key"},{"detail":"May check for the presence of a forensics/monitoring tool"},{"detail":"Contains ability to adjust token privileges"}],"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]}],"intel_graph":{"map":{},"chains":[]}},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":54,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":22,"registry_keys_modified_count":0,"registry_keys_deleted_count":2,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":24,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["evasive"],"sample_flags":["Sample Crashed"],"sandbox_reports":[{"id":"6ad89f0f5cd9670e9b0fe3ac","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"ABTrojan.TTHB","submit_name":"draftview.exe","analysis_start_time":"2026-10-21T11:16:34+00:00","indicators_count":{"informative":152,"suspicious":40,"malicious":1},"tags":["Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}],"processes":[{"pid":5364,"ppid":0,"name":"draftview.exe","command_line":"","sha256":"f9ff28b32522bf4ac0e8f9fa1b392ce43bd26d0b6b70d4c521a2ad67f4a8cbed","normalized_path":"C:\\draftview.exe","uid":"00000000-00005364","icon":"$39"},{"pid":3720,"ppid":5364,"name":"WerFault.exe","command_line":"-u -p 5364 -s 948","sha256":"0b7f2ca998ecf2a623e04f565354a09091e0a35c8442d7d9b6812b64b9121bc2","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00005364","uid":"00000000-00003720"},{"pid":2480,"ppid":5364,"name":"WerFault.exe","command_line":"-u -p 5364 -s 948","sha256":"0b7f2ca998ecf2a623e04f565354a09091e0a35c8442d7d9b6812b64b9121bc2","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00005364","uid":"00000000-00002480"},{"pid":4720,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 444 -p 5364 -ip 5364","sha256":"0b7f2ca998ecf2a623e04f565354a09091e0a35c8442d7d9b6812b64b9121bc2","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00004720","icon":"$3a"}],"all_imported_dlls":["kernel.appcore.dll","AppXDeploymentClient.dll","gdi32full.dll","crypt32.dll","sspicli.dll","D3D12.dll","msctf.dll","advapi32.dll","sechost.dll","oleaut32.dll","dwmapi.dll","uxtheme.dll","powrprof.dll","cryptsp.dll","msvcrt.dll","KernelBase.dll","ucrtbase.dll","user32.dll","ole32.dll","pdh.dll","ws2_32.dll","fltLib.dll","ResourcePolicyClient.dll","kernel32.dll","win32u.dll","msvcp_win.dll","combase.dll","gdi32.dll","shlwapi.dll","cryptbase.dll","umpdc.dll","ntdll.dll","glu32.dll","shell32.dll","vcruntime140.dll","directxdatabasehelper.dll","clbcatq.dll","vm3dglhelper64.dll","winmm.dll","apphelp.dll","bcrypt.dll","D3DCompiler_47.dll","secur32.dll","VxSSL64.dll","msvcp140.dll","vcruntime140_1.dll","dxgi.dll","rpcrt4.dll","bcryptprimitives.dll","psapi.dll","DXCore.dll","vm3dgl64.dll","imm32.dll","opengl32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\SLDWORKS\\","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"key":"HKCUHKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"key":"HKCUHKCU\\SOFTWARE\\VMWARE, INC.\\","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"key":"HKCUHKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"key":"HKCUHKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"key":"HKCUHKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\HEAVEN\\","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"key":"HKCUHKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\HEAVEN64\\","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"key":"HKCUHKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\UNIGINE\\","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"key":"HKCUHKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\VALLEY\\","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"key":"HKCUHKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\JK2SP\\","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"key":"HKCUHKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\CODSP\\","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"key":"HKCUHKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\CODSP_NOCD\\","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"key":"HKCUHKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\VIEWPERF\\","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"key":"HKCUHKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\GPUTEST\\","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"key":"HKCUHKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\GPUTESTGUI\\","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"key":"HKCUHKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\NOBELCLINICIANVIEWER\\","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"key":"HKCUHKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\PHOTOSHOP\\","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"key":"HKCUHKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\RECAP\\","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"key":"HKCUHKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\SHADERTOYMARK\\","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"key":"HKCUHKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\SWKOTOR\\","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"key":"HKCUHKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\SPAZIO3D\\","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"key":"HKCUHKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\GLOBAL_MAPPER\\","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCUHKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\GPUTEST\\GLSLVERSION\\GLSLVERSION","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"key":"HKCUHKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\GPUTESTGUI\\GLSLVERSION\\GLSLVERSION","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5364:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5364:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"name":"Local\\SM0:5364:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]},{"name":"SM0:5364:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad89f0f5cd9670e9b0fe3ac"}]}]}},"report_ids":{"sandbox_job_ids":["6ad89f0f5cd9670e9b0fe3ac"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Win/malicious_confidence_100% Sample f9ff28b32522… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample f9ff28b32522…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 6/25 AV engines flagged this file. 1 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/f9ff28b32522bf4ac0e8f9fa1b392ce43bd26d0b6b70d4c521a2ad67f4a8cbed"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_100% Sample f9ff28b32522… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample f9ff28b32522…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 6/25 AV engines flagged this file. 1 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/f9ff28b32522bf4ac0e8f9fa1b392ce43bd26d0b6b70d4c521a2ad67f4a8cbed"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_100% Sample f9ff28b32522… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample f9ff28b32522…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 6/25 AV engines flagged this file. 1 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3b","11",{}]]